18 lines
979 B
Plaintext
18 lines
979 B
Plaintext
|
|
rule Worm_Win32_Taterf_gen_A{
|
|
meta:
|
|
description = "Worm:Win32/Taterf.gen!A,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 09 00 08 00 00 08 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {40 83 f8 20 90 02 06 72 90 01 01 8b 0d 90 01 02 00 10 33 c0 85 c9 90 02 10 8a 98 90 01 02 00 10 32 da 88 98 90 01 02 00 10 40 3b c1 72 90 00 } //07 00
|
|
$a_03_1 = {10 83 f8 03 74 09 83 f8 02 90 09 1f 00 90 02 0c 43 8a 90 09 50 00 90 02 26 68 88 13 00 00 ff 15 90 00 } //02 00
|
|
$a_01_2 = {53 68 6f 77 53 75 70 65 72 48 69 64 64 65 6e 00 48 69 64 64 65 6e 00 } //02 00
|
|
$a_01_3 = {63 6f 63 2e 65 78 65 00 61 61 61 2e 64 61 74 } //03 00
|
|
$a_01_4 = {75 72 6c 69 6e 66 6f 00 43 4c 53 49 44 5c 4d 41 44 4f 57 4e } //01 00 牵楬普o䱃䥓屄䅍佄乗
|
|
$a_01_5 = {61 75 74 6f 72 75 6e 2e 69 6e 66 00 } //01 00
|
|
$a_01_6 = {47 65 74 44 72 69 76 65 54 79 70 65 41 } //01 00 GetDriveTypeA
|
|
$a_01_7 = {4e 6f 44 72 69 76 65 54 79 70 65 41 75 74 6f 52 75 6e } //00 00 NoDriveTypeAutoRun
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |