24 lines
1.6 KiB
Plaintext
24 lines
1.6 KiB
Plaintext
|
|
rule Backdoor_Win32_Buminpom_A{
|
|
meta:
|
|
description = "Backdoor:Win32/Buminpom.A,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 0e 00 00 14 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {6d 00 61 00 63 00 5f 00 61 00 64 00 64 00 72 00 3d 00 25 00 73 00 } //01 00 mac_addr=%s
|
|
$a_01_1 = {2f 00 2f 00 41 00 70 00 70 00 44 00 6f 00 77 00 6e 00 55 00 52 00 4c 00 } //01 00 //AppDownURL
|
|
$a_01_2 = {2f 00 2f 00 43 00 61 00 63 00 68 00 65 00 44 00 65 00 6c 00 65 00 74 00 65 00 } //01 00 //CacheDelete
|
|
$a_01_3 = {2f 00 2f 00 43 00 6d 00 64 00 53 00 65 00 72 00 76 00 65 00 72 00 } //01 00 //CmdServer
|
|
$a_01_4 = {2f 00 2f 00 43 00 6d 00 64 00 55 00 70 00 64 00 61 00 74 00 65 00 54 00 69 00 6d 00 65 00 } //01 00 //CmdUpdateTime
|
|
$a_01_5 = {2f 00 2f 00 43 00 6e 00 74 00 57 00 69 00 6e 00 64 00 6f 00 77 00 } //01 00 //CntWindow
|
|
$a_01_6 = {2f 00 2f 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 } //01 00 //CookieDomain
|
|
$a_01_7 = {2f 00 2f 00 4a 00 53 00 45 00 78 00 65 00 63 00 } //01 00 //JSExec
|
|
$a_01_8 = {2f 00 2f 00 55 00 70 00 64 00 61 00 74 00 65 00 55 00 52 00 4c 00 } //01 00 //UpdateURL
|
|
$a_01_9 = {2f 00 2f 00 57 00 61 00 69 00 74 00 54 00 69 00 6d 00 65 00 } //01 00 //WaitTime
|
|
$a_01_10 = {2f 00 2f 00 64 00 65 00 6c 00 61 00 79 00 57 00 69 00 6e 00 64 00 6f 00 77 00 } //01 00 //delayWindow
|
|
$a_01_11 = {2f 00 2f 00 66 00 69 00 6c 00 65 00 44 00 6f 00 77 00 6e 00 } //01 00 //fileDown
|
|
$a_01_12 = {2f 00 2f 00 69 00 66 00 4a 00 53 00 52 00 55 00 4e 00 } //01 00 //ifJSRUN
|
|
$a_01_13 = {2f 00 2f 00 69 00 66 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 } //00 00 //ifRandom
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |