76 lines
12 KiB
Plaintext
76 lines
12 KiB
Plaintext
|
|
rule TrojanSpy_Win32_Banker_USY{
|
|
meta:
|
|
description = "TrojanSpy:Win32/Banker.USY,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 42 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 54 32 4b 35 44 4d 42 61 4c 4f 48 47 } //1 T65pQsjfR6mWBsOWBsbj84T2K5DMBaLOHG
|
|
$a_01_1 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 6a 31 4c 62 31 36 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj84j1Lb16BcLuPG
|
|
$a_01_2 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 6a 58 54 59 76 62 55 36 4b } //1 T65pQsjfR6mWBsOWBsbj84jXTYvbU6K
|
|
$a_01_3 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 50 36 35 70 51 32 76 62 55 36 4b } //1 T65pQsjfR6mWBsOWBsbj86rZP65pQ2vbU6K
|
|
$a_01_4 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 72 5a 50 36 4c 71 50 4d 44 71 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj84rZP6LqPMDqBcLuPG
|
|
$a_01_5 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 53 63 4c 64 54 73 62 77 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86rZScLdTsbwBcLuPG
|
|
$a_01_6 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 72 5a 4c 37 44 68 53 73 58 61 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj84rZL7DhSsXaBcLuPG
|
|
$a_01_7 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 54 4e 31 61 52 4d 54 6f 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86rZTN1aRMToBcLuPG
|
|
$a_01_8 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 54 4e 31 61 54 4d 61 6b 50 4e 58 62 } //1 T65pQsjfR6mWBsOWBsbj86rZTN1aTMakPNXb
|
|
$a_01_9 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 72 6d 50 61 35 64 50 4d 76 71 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj84rmPa5dPMvqBcLuPG
|
|
$a_01_10 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 72 6d 50 61 44 6c 52 64 44 6c 52 36 4b 6b 50 4e 58 62 } //1 T65pQsjfR6mWBsOWBsbj84rmPaDlRdDlR6KkPNXb
|
|
$a_01_11 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 72 6d 50 62 44 62 53 64 50 66 4f 73 4b 6b 50 4e 58 62 } //1 T65pQsjfR6mWBsOWBsbj84rmPbDbSdPfOsKkPNXb
|
|
$a_01_12 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 72 6d 50 62 48 6f 4f 4e 61 6b 50 4e 58 62 } //1 T65pQsjfR6mWBsOWBsbj84rmPbHoONakPNXb
|
|
$a_01_13 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 72 6d 50 62 54 66 55 63 35 6f 50 32 76 62 55 36 4b } //1 T65pQsjfR6mWBsOWBsbj84rmPbTfUc5oP2vbU6K
|
|
$a_01_14 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 73 54 37 57 6b 50 4e 58 62 } //1 T65pQsjfR6mWBsOWBsbj86rsT7WkPNXb
|
|
$a_01_15 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 4f 4e 31 6d 51 4d 76 70 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86rZON1mQMvpBcLuPG
|
|
$a_01_16 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 51 4d 76 63 52 6f 76 62 55 36 4b } //1 T65pQsjfR6mWBsOWBsbj86rZQMvcRovbU6K
|
|
$a_01_17 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 64 51 37 48 6a 52 32 76 62 55 36 4b } //1 T65pQsjfR6mWBsOWBsbj86rdQ7HjR2vbU6K
|
|
$a_01_18 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 51 4d 76 70 54 4e 31 61 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86rZQMvpTN1aBcLuPG
|
|
$a_01_19 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 52 4d 76 65 50 36 6e 6f 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86rZRMveP6noBcLuPG
|
|
$a_01_20 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 72 5a 4b 73 58 66 50 4d 6e 61 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj84rZKsXfPMnaBcLuPG
|
|
$a_01_21 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 34 72 5a 4c 62 44 35 53 73 44 6b 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj84rZLbD5SsDkBcLuPG
|
|
$a_01_22 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 54 64 44 63 54 37 44 6b 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86rZTdDcT7DkBcLuPG
|
|
$a_01_23 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 72 5a 54 64 44 6a 4f 4e 30 6b 50 4e 58 62 } //1 T65pQsjfR6mWBsOWBsbj86rZTdDjON0kPNXb
|
|
$a_01_24 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 76 58 51 4d 35 73 50 63 62 6b 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86vXQM5sPcbkBcLuPG
|
|
$a_01_25 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 7a 58 53 73 44 69 52 64 47 6b 50 4e 58 62 } //1 T65pQsjfR6mWBsOWBsbj86zXSsDiRdGkPNXb
|
|
$a_01_26 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 54 5a 4f 4e 44 4a 50 4e 39 73 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86TZONDJPN9sBcLuPG
|
|
$a_01_27 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 37 66 69 4f 73 6e 66 50 4d 76 71 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj87fiOsnfPMvqBcLuPG
|
|
$a_01_28 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 35 73 50 73 4c 6a 4f 6f 76 62 55 36 4b } //1 T65pQsjfR6mWBsOWBsbj865sPsLjOovbU6K
|
|
$a_01_29 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 35 73 50 74 4c 6d 53 74 50 5a 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj865sPtLmStPZBcLuPG
|
|
$a_01_30 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 35 73 50 73 35 6a 53 74 50 6f 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj865sPs5jStPoBcLuPG
|
|
$a_01_31 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 35 73 50 73 44 5a 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj865sPsDZBcLuPG
|
|
$a_01_32 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 35 70 51 36 48 66 53 74 30 6b 50 4e 58 62 } //1 T65pQsjfR6mWBsOWBsbj865pQ6HfSt0kPNXb
|
|
$a_01_33 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 35 70 51 36 72 58 51 4e 44 73 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj865pQ6rXQNDsBcLuPG
|
|
$a_01_34 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 35 70 51 37 44 62 53 64 4f 6b 50 4e 58 62 } //1 T65pQsjfR6mWBsOWBsbj865pQ7DbSdOkPNXb
|
|
$a_01_35 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 35 70 51 37 54 62 4f 64 44 73 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj865pQ7TbOdDsBcLuPG
|
|
$a_01_36 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 35 70 54 74 4c 6d 50 37 44 73 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj865pTtLmP7DsBcLuPG
|
|
$a_01_37 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 44 5a 53 73 4c 71 52 4d 54 6f 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86DZSsLqRMToBcLuPG
|
|
$a_01_38 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 44 5a 4f 74 31 6f 52 74 58 76 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86DZOt1oRtXvBcLuPG
|
|
$a_01_39 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 44 5a 4f 4e 31 6d 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86DZON1mBcLuPG
|
|
$a_01_40 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 44 5a 50 4e 50 71 52 4d 54 6f 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86DZPNPqRMToBcLuPG
|
|
$a_01_41 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 76 6c 50 33 43 6f 51 74 39 6b 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86vlP3CoQt9kBcLuPG
|
|
$a_01_42 = {54 36 35 70 51 73 6a 66 52 36 6d 57 42 73 4f 57 42 73 62 6a 38 36 76 6c 50 33 43 6f 51 74 4c 66 42 63 4c 75 50 47 } //1 T65pQsjfR6mWBsOWBsbj86vlP3CoQtLfBcLuPG
|
|
$a_01_43 = {4e 35 44 6c 50 64 48 74 4f 4e 39 62 4e 34 72 66 4f 74 39 6c 53 73 7a 63 54 35 6e 4e 51 4d 76 61 52 74 54 70 4e 34 44 72 53 64 39 62 52 64 48 4d 50 4e 39 70 51 4d 7a 6b 4e 35 39 72 52 57 } //1 N5DlPdHtON9bN4rfOt9lSszcT5nNQMvaRtTpN4DrSd9bRdHMPN9pQMzkN59rRW
|
|
$a_01_44 = {51 37 48 71 53 37 43 77 42 6f 7a 74 54 74 53 6f 42 63 39 58 52 63 44 6c 4f 64 39 58 53 73 62 69 42 63 44 6c 52 49 76 59 53 59 7a 58 4f 4e 31 63 42 73 6e 6c 50 73 62 6b 42 63 66 70 53 33 7a 58 4f 4e 31 63 42 61 62 34 49 33 72 70 51 4d 71 } //2 Q7HqS7CwBoztTtSoBc9XRcDlOd9XSsbiBcDlRIvYSYzXON1cBsnlPsbkBcfpS3zXON1cBab4I3rpQMq
|
|
$a_01_45 = {49 35 48 4b 4b 35 54 4e 4c 71 44 31 49 4c 58 31 47 71 7a 44 47 62 39 49 48 4b 48 39 4b 61 4c 33 4c 34 6e 39 4a 61 6a 4a 4b 61 62 45 4c 34 4c 49 4a 61 4c 4b 47 71 35 39 4d 34 35 31 4b 72 30 } //2 I5HKK5TNLqD1ILX1GqzDGb9IHKH9KaL3L4n9JajJKabEL4LIJaLKGq59M451Kr0
|
|
$a_01_46 = {49 4b 76 4b 48 4c 39 45 48 4c 48 32 47 4b 76 42 49 4b 76 37 47 71 35 39 4d 34 34 } //2 IKvKHL9EHLH2GKvBIKv7Gq59M44
|
|
$a_01_47 = {47 63 35 6b 4f 73 79 57 47 64 39 58 50 36 4c 70 4f 73 79 57 4b 6f 7a 31 } //2 Gc5kOsyWGd9XP6LpOsyWKoz1
|
|
$a_01_48 = {4c 4d 76 66 4f 63 35 6b 4f 73 79 6b 4f 73 7a 6a } //2 LMvfOc5kOsykOszj
|
|
$a_01_49 = {4b 73 35 6b 54 36 35 6b 50 36 4c 6f } //2 Ks5kT65kP6Lo
|
|
$a_01_50 = {4b 36 7a 6f 54 36 35 69 38 34 39 31 4a 61 44 46 38 35 39 35 47 4b 6d 57 42 49 31 31 47 61 75 57 47 4b 72 49 4a 6d } //2 K6zoT65i8491JaDF8595GKmWBI11GauWGKrIJm
|
|
$a_01_51 = {4b 61 4c 34 48 4b 44 31 4b 61 47 57 42 49 31 31 52 4d 39 66 50 4d 76 71 50 49 31 4a 50 4d 54 72 53 63 79 57 50 36 4b 57 4b 36 35 64 4f 4d 72 62 52 64 48 6c } //2 KaL4HKD1KaGWBI11RM9fPMvqPI1JPMTrScyWP6KWK65dOMrbRdHl
|
|
$a_01_52 = {51 37 48 71 53 37 43 77 42 6f 7a 5a 4f 64 30 6b 43 73 48 70 52 73 6e 72 54 36 62 6c 52 59 76 5a 52 73 71 6b 4f 64 38 6c 4f 73 39 6d 42 73 44 59 53 32 76 73 51 4e 44 58 52 63 4c 71 } //2 Q7HqS7CwBozZOd0kCsHpRsnrT6blRYvZRsqkOd8lOs9mBsDYS2vsQNDXRcLq
|
|
$a_01_53 = {4c 73 4c 69 4f 73 7a 6a 50 49 30 6a 38 35 31 58 55 4c 31 58 52 30 } //2 LsLiOszjPI0j851XUL1XR0
|
|
$a_01_54 = {47 74 39 62 50 36 62 5a 4f 4e 39 61 38 34 44 66 54 36 61 57 4b 36 7a 6f 54 36 35 69 } //2 Gt9bP6bZON9a84DfT6aWK6zoT65i
|
|
$a_01_55 = {4a 61 7a 4a 4b 71 35 33 47 4b 62 4f 47 4b 76 35 4c 34 39 31 4a 61 6a 39 4a 61 53 } //2 JazJKq53GKbOGKv5L491Jaj9JaS
|
|
$a_01_56 = {47 63 35 6b 4f 73 79 57 4a 63 7a 70 53 73 34 57 47 73 35 66 55 36 34 57 4b 6f 76 31 } //2 Gc5kOsyWJczpSs4WGs5fU64WKov1
|
|
$a_01_57 = {4a 4d 4c 6f 4f 73 35 61 52 71 6e 66 54 64 39 62 38 34 39 6f 4f 4e 44 66 52 30 } //2 JMLoOs5aRqnfTd9b849oONDfR0
|
|
$a_01_58 = {4c 32 31 39 38 34 71 57 42 49 31 34 38 35 43 57 48 59 31 4e 38 34 4b 57 47 57 } //2 L21984qWBI1485CWHY1N84KWGW
|
|
$a_01_59 = {49 4d 76 63 52 73 39 72 53 73 44 58 } //2 IMvcRs9rSsDX
|
|
$a_01_60 = {4b 61 4c 34 48 49 31 39 4a 61 50 46 4b 71 4c 37 38 32 71 57 4b 71 4c 45 47 4c 44 47 38 32 71 57 4c 36 4c 5a 52 36 35 61 52 6f 31 4d 51 4e 39 71 54 4d 35 69 } //2 KaL4HI19JaPFKqL782qWKqLEGLDG82qWL6LZR65aRo1MQN9qTM5i
|
|
$a_01_61 = {47 63 4c 6a 42 4e 50 66 52 63 48 6c 38 36 35 6c 38 34 43 57 51 49 31 71 38 36 61 57 47 59 31 31 38 34 75 57 49 6f 31 32 38 37 38 57 4f 49 31 70 38 36 61 57 52 30 } //2 GcLjBNPfRcHl865l84CWQI1q86aWGY1184uWIo12878WOI1p86aWR0
|
|
$a_01_62 = {47 61 4c 4a 47 6f 30 6a 38 34 39 58 52 63 44 6c 38 36 48 6c 38 34 4c 70 54 36 35 61 52 6f 31 61 50 49 31 4a 4f 4d 76 71 4f 49 31 33 4f 4e 48 58 53 63 62 6b 4f 47 } //2 GaLJGo0j849XRcDl86Hl84LpT65aRo1aPI1JOMvqOI13ONHXScbkOG
|
|
$a_01_63 = {47 63 35 6b 4f 73 79 57 4b 73 35 63 53 63 34 57 4b 6f 76 31 42 57 } //2 Gc5kOsyWKs5cSc4WKov1BW
|
|
$a_01_64 = {47 63 35 6b 4f 73 79 57 4b 64 4c 6f 4f 4d 6d } //2 Gc5kOsyWKdLoOMm
|
|
$a_01_65 = {47 64 39 58 50 36 4c 70 4f 73 79 57 4b 37 39 66 52 4d 4b } //2 Gd9XP6LpOsyWK79fRMK
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*2+(#a_01_45 & 1)*2+(#a_01_46 & 1)*2+(#a_01_47 & 1)*2+(#a_01_48 & 1)*2+(#a_01_49 & 1)*2+(#a_01_50 & 1)*2+(#a_01_51 & 1)*2+(#a_01_52 & 1)*2+(#a_01_53 & 1)*2+(#a_01_54 & 1)*2+(#a_01_55 & 1)*2+(#a_01_56 & 1)*2+(#a_01_57 & 1)*2+(#a_01_58 & 1)*2+(#a_01_59 & 1)*2+(#a_01_60 & 1)*2+(#a_01_61 & 1)*2+(#a_01_62 & 1)*2+(#a_01_63 & 1)*2+(#a_01_64 & 1)*2+(#a_01_65 & 1)*2) >=10
|
|
|
|
} |