15 lines
1.1 KiB
Plaintext
15 lines
1.1 KiB
Plaintext
|
|
rule TrojanDownloader_Win32_Bancos_U{
|
|
meta:
|
|
description = "TrojanDownloader:Win32/Bancos.U,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0a 00 05 00 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {8b c0 55 8b ec 6a 00 33 c0 55 68 90 01 02 45 00 64 ff 30 64 89 20 e8 90 01 02 fb ff b8 90 01 02 45 00 e8 90 01 02 fd ff 90 03 06 06 b8 90 01 02 45 00 68 90 01 02 00 00 e8 90 01 02 fb ff 90 02 0a 84 c0 74 05 e8 90 01 02 fb ff 90 03 01 01 b8 ba 90 01 02 45 00 90 03 01 01 b8 ba 90 01 02 45 00 e8 90 01 01 ff ff ff 90 00 } //5
|
|
$a_00_1 = {55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 } //5 URLDownloadToFileA
|
|
$a_01_2 = {4d 69 63 72 6f 73 6f 66 74 20 50 6f 77 65 72 20 50 6f 69 6e 74 20 6e e3 6f 20 63 6f 6e 73 65 67 75 69 75 20 76 69 73 75 61 6c 69 7a 61 72 20 65 73 74 65 20 61 72 71 75 69 76 6f 21 00 } //1
|
|
$a_01_3 = {57 6f 72 64 50 61 64 20 6e e3 6f 20 63 6f 6e 73 65 67 75 69 75 20 76 69 73 75 61 6c 69 7a 61 72 20 65 73 74 65 20 61 72 71 75 69 76 6f 21 00 } //1
|
|
$a_01_4 = {72 65 64 69 72 65 63 69 6f 6e 61 64 6f 20 70 61 72 61 20 6e 6f 73 73 6f 20 73 69 74 65 21 00 } //1
|
|
condition:
|
|
((#a_03_0 & 1)*5+(#a_00_1 & 1)*5+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=10
|
|
|
|
} |