15 lines
1.2 KiB
Plaintext
15 lines
1.2 KiB
Plaintext
|
|
rule TrojanSpy_Win32_Bafi_N{
|
|
meta:
|
|
description = "TrojanSpy:Win32/Bafi.N,SIGNATURE_TYPE_PEHSTR_EXT,ffffffe6 00 ffffffd2 00 05 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {81 e1 0f 00 00 80 79 05 49 83 c9 f0 41 88 4d ff 8a 4c 30 02 32 cb 8b 1a 88 0c 18 8a 5c 30 02 40 3b c7 7c d1 } //100
|
|
$a_01_1 = {53 00 54 00 50 00 41 00 43 00 00 00 57 00 45 00 } //100
|
|
$a_01_2 = {43 00 6c 00 61 00 73 00 73 00 65 00 73 00 5c 00 6c 00 69 00 6e 00 6b 00 72 00 64 00 2e 00 41 00 49 00 45 00 62 00 68 00 6f 00 5c 00 43 00 4c 00 53 00 49 00 44 00 } //20 Classes\linkrd.AIEbho\CLSID
|
|
$a_01_3 = {38 00 42 00 42 00 45 00 36 00 41 00 37 00 30 00 2d 00 45 00 46 00 38 00 34 00 2d 00 34 00 37 00 46 00 41 00 2d 00 42 00 35 00 44 00 45 00 2d 00 45 00 44 00 44 00 30 00 44 00 46 00 31 00 38 00 34 00 36 00 31 00 46 00 } //10 8BBE6A70-EF84-47FA-B5DE-EDD0DF18461F
|
|
$a_01_4 = {46 00 35 00 33 00 35 00 44 00 44 00 32 00 44 00 2d 00 39 00 33 00 33 00 39 00 2d 00 34 00 38 00 45 00 44 00 2d 00 41 00 33 00 37 00 38 00 2d 00 36 00 31 00 30 00 38 00 34 00 42 00 31 00 30 00 34 00 39 00 41 00 42 00 } //10 F535DD2D-9339-48ED-A378-61084B1049AB
|
|
condition:
|
|
((#a_01_0 & 1)*100+(#a_01_1 & 1)*100+(#a_01_2 & 1)*20+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10) >=210
|
|
|
|
} |