15 lines
2.6 KiB
Plaintext
15 lines
2.6 KiB
Plaintext
|
|
rule TrojanDownloader_Win32_Bancos_GN{
|
|
meta:
|
|
description = "TrojanDownloader:Win32/Bancos.GN,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 00 33 00 36 00 62 00 37 00 39 00 37 00 30 00 36 00 35 00 32 00 65 00 37 00 61 00 36 00 39 00 37 00 30 00 } //1 536b7970652e7a6970
|
|
$a_01_1 = {35 00 63 00 35 00 33 00 36 00 62 00 37 00 39 00 37 00 30 00 36 00 35 00 } //1 5c536b797065
|
|
$a_01_2 = {36 00 38 00 37 00 34 00 37 00 34 00 37 00 30 00 33 00 61 00 32 00 66 00 32 00 66 00 36 00 65 00 37 00 33 00 33 00 31 00 33 00 31 00 33 00 36 00 32 00 65 00 36 00 38 00 36 00 66 00 37 00 33 00 37 00 34 00 36 00 37 00 36 00 31 00 37 00 34 00 36 00 66 00 37 00 32 00 32 00 65 00 36 00 33 00 36 00 66 00 36 00 64 00 32 00 65 00 36 00 32 00 37 00 32 00 32 00 66 00 37 00 65 00 36 00 64 00 36 00 31 00 37 00 32 00 36 00 62 00 36 00 35 00 33 00 31 00 33 00 32 00 33 00 36 00 32 00 66 00 36 00 37 00 37 00 35 00 36 00 39 00 36 00 32 00 32 00 66 00 36 00 37 00 37 00 32 00 36 00 66 00 37 00 36 00 36 00 35 00 32 00 65 00 37 00 30 00 36 00 38 00 37 00 30 00 } //1 687474703a2f2f6e733131362e686f73746761746f722e636f6d2e62722f7e6d61726b653132362f677569622f67726f76652e706870
|
|
$a_01_3 = {35 00 63 00 35 00 33 00 36 00 62 00 37 00 39 00 37 00 30 00 36 00 35 00 35 00 63 00 33 00 37 00 33 00 34 00 33 00 36 00 36 00 36 00 33 00 36 00 36 00 34 00 33 00 36 00 33 00 35 00 33 00 36 00 36 00 35 00 33 00 37 00 33 00 35 00 33 00 36 00 33 00 33 00 33 00 37 00 33 00 35 00 33 00 36 00 33 00 31 00 33 00 37 00 33 00 36 00 33 00 36 00 33 00 31 00 33 00 37 00 33 00 33 00 33 00 37 00 33 00 34 00 32 00 65 00 36 00 35 00 37 00 38 00 36 00 35 00 } //1 5c536b7970655c37343666366436353665373536333735363137363631373337342e657865
|
|
$a_01_4 = {36 00 38 00 37 00 34 00 37 00 34 00 37 00 30 00 33 00 61 00 32 00 66 00 32 00 66 00 36 00 65 00 37 00 33 00 33 00 36 00 33 00 35 00 33 00 38 00 32 00 65 00 36 00 38 00 36 00 66 00 37 00 33 00 37 00 34 00 36 00 37 00 36 00 31 00 37 00 34 00 36 00 66 00 37 00 32 00 32 00 65 00 36 00 33 00 36 00 66 00 36 00 64 00 32 00 65 00 36 00 32 00 37 00 32 00 32 00 66 00 37 00 65 00 36 00 64 00 36 00 31 00 37 00 32 00 36 00 62 00 36 00 35 00 33 00 37 00 33 00 35 00 33 00 34 00 32 00 66 00 36 00 65 00 36 00 66 00 37 00 36 00 36 00 31 00 37 00 33 00 32 00 66 00 36 00 34 00 36 00 39 00 37 00 32 00 32 00 66 00 35 00 33 00 36 00 62 00 37 00 39 00 37 00 30 00 36 00 35 00 32 00 65 00 37 00 61 00 36 00 39 00 37 00 30 00 } //1 687474703a2f2f6e733635382e686f73746761746f722e636f6d2e62722f7e6d61726b653735342f6e6f7661732f6469722f536b7970652e7a6970
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=3
|
|
|
|
} |