14 lines
994 B
Plaintext
14 lines
994 B
Plaintext
|
|
rule VirTool_Win64_Plebledesz_A_MTB{
|
|
meta:
|
|
description = "VirTool:Win64/Plebledesz.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {48 89 10 44 0f 11 78 08 48 c7 40 18 02 00 00 00 44 0f 11 78 20 48 8b 54 24 30 48 89 50 30 48 8b 90 01 05 48 89 c3 b9 07 00 00 00 48 89 cf 48 89 d0 e8 90 01 04 0f 1f 40 00 48 83 90 00 } //01 00
|
|
$a_03_1 = {48 89 7c 24 28 48 89 74 24 58 48 39 f9 90 01 02 48 89 ca 48 29 f9 0f 1f 44 00 00 48 39 ca 0f 82 90 01 04 49 90 00 } //01 00
|
|
$a_03_2 = {48 89 6c 24 38 48 90 01 04 48 c7 44 24 20 00 00 00 00 e8 90 01 04 48 85 db 90 01 02 bb 28 00 00 00 48 90 01 04 e8 90 01 04 48 85 c0 90 01 02 44 0f 11 7c 24 28 48 8d 90 00 } //01 00
|
|
$a_03_3 = {48 89 8c 24 80 01 00 00 48 89 84 24 88 01 00 00 48 8d 8c 90 01 05 48 89 4c 24 40 48 8d 90 01 03 e8 53 90 01 03 85 c0 0f 85 90 01 04 48 8b 90 01 05 48 8b 0d 05 60 1d 00 48 8b 3d 06 60 1d 00 48 8b 84 24 50 01 00 00 e8 90 01 04 48 85 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |