13 lines
2.5 KiB
Plaintext
13 lines
2.5 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Trickbot_SM_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Trickbot.SM!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {49 59 77 49 41 42 4a 41 47 34 41 64 67 42 76 41 47 73 41 5a 51 41 74 41 46 63 41 5a 51 42 69 41 46 49 41 5a 51 42 78 41 48 55 41 5a 51 42 7a 41 48 51 41 49 41 41 74 41 46 55 41 63 67 42 70 41 43 41 41 49 67 59 77 49 42 6f 41 48 51 41 64 41 42 77 41 44 6f 41 4c 77 41 76 41 44 51 41 4e 51 41 75 41 44 45 41 4e 41 41 34 41 43 34 41 4d 51 41 79 41 44 41 41 4c 67 41 7a 41 44 55 41 4c 77 42 70 41 47 30 41 59 51 42 59 77 49 6e 41 47 55 41 63 77 41 76 41 48 4d 41 64 51 42 69 41 48 6f 41 5a 51 42 79 41 47 38 41 4c 67 42 77 41 47 34 41 5a 77 41 69 41 43 41 41 4c 51 42 50 41 48 55 41 64 41 42 59 77 49 47 41 47 6b 41 62 41 42 6c 41 43 41 41 49 67 42 44 41 44 6f 41 58 41 42 51 } //1 IYwIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAIgYwIBoAHQAdABwADoALwAvADQANQAuADEANAA4AC4AMQAyADAALgAzADUALwBpAG0AYQBYwInAGUAcwAvAHMAdQBiAHoAZQByAG8ALgBwAG4AZwAiACAALQBPAHUAdABYwIGAGkAbABlACAAIgBDADoAXABQ
|
|
$a_01_1 = {41 48 49 41 62 77 42 6e 41 48 49 41 59 51 42 74 41 45 51 41 59 51 42 30 41 47 45 41 58 41 42 6a 41 47 77 41 59 67 41 75 41 47 51 41 62 41 42 73 41 43 49 59 77 49 41 20 59 77 49 26 20 73 59 77 49 74 61 59 77 49 72 59 77 49 74 20 59 77 49 43 59 77 49 3a 59 77 49 5c 59 77 49 57 69 59 77 49 6e 64 59 77 49 6f 59 77 49 77 59 77 49 73 5c 59 77 49 53 79 59 77 49 73 59 77 49 74 65 59 77 49 6d 33 59 77 49 32 5c 72 59 77 49 75 6e 59 77 49 64 6c 59 77 49 6c 33 59 77 49 32 2e 59 77 49 65 59 77 49 78 59 77 49 65 20 59 77 49 43 59 77 49 3a 59 77 49 5c 59 77 49 50 72 59 77 49 6f 67 59 77 49 72 59 77 49 61 6d 59 77 49 44 59 77 49 61 74 59 77 49 61 5c 63 59 77 49 6c 62 2e 64 59 77 49 6c 59 77 49 6c 2c 53 64 79 59 77 49 77 48 61 59 77 49 6e 64 } //1 AHIAbwBnAHIAYQBtAEQAYQB0AGEAXABjAGwAYgAuAGQAbABsACIYwIA YwI& sYwItaYwIrYwIt YwICYwI:YwI\YwIWiYwIndYwIoYwIwYwIs\YwISyYwIsYwIteYwIm3YwI2\rYwIunYwIdlYwIl3YwI2.YwIeYwIxYwIe YwICYwI:YwI\YwIPrYwIogYwIrYwIamYwIDYwIatYwIa\cYwIlb.dYwIlYwIl,SdyYwIwHaYwInd
|
|
$a_01_2 = {22 68 77 45 43 68 77 45 3a 68 77 45 5c 68 77 45 57 68 77 45 69 6e 68 77 45 64 68 77 45 6f 68 77 45 77 73 68 77 45 5c 53 68 77 45 79 73 68 77 45 74 65 68 77 45 6d 33 68 77 45 32 5c 63 68 77 45 6d 68 77 45 64 2e 68 77 45 65 68 77 45 78 68 77 45 65 22 } //1 "hwEChwE:hwE\hwEWhwEinhwEdhwEohwEwshwE\ShwEyshwEtehwEm3hwE2\chwEmhwEd.hwEehwExhwEe"
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
|
|
|
|
} |