15 lines
574 B
Plaintext
15 lines
574 B
Plaintext
|
|
rule Worm_Win32_Pricbot_A{
|
|
meta:
|
|
description = "Worm:Win32/Pricbot.A,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 05 00 00 0a 00 "
|
|
|
|
strings :
|
|
$a_02_0 = {6a 07 8d 8d c8 fd ff ff 51 8d 8d ec fd ff ff e8 90 01 02 ff ff c6 45 fc 23 90 00 } //0a 00
|
|
$a_00_1 = {5b 61 75 74 6f 72 75 6e 5d } //01 00 [autorun]
|
|
$a_00_2 = {50 61 73 73 70 6f 72 74 2e 4e 65 74 5c 2a } //01 00 Passport.Net\*
|
|
$a_01_3 = {44 69 73 61 62 6c 65 4e 6f 74 69 66 79 } //01 00 DisableNotify
|
|
$a_00_4 = {46 6c 6f 6f 64 20 73 74 61 72 74 65 64 } //00 00 Flood started
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |