13 lines
446 B
Plaintext
13 lines
446 B
Plaintext
|
|
rule Backdoor_Win32_DarkView_B{
|
|
meta:
|
|
description = "Backdoor:Win32/DarkView.B,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 02 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {49 6e 6a 65 63 74 65 64 20 74 6f 3a 20 } //04 00 Injected to:
|
|
$a_01_1 = {5c 78 63 6f 6e 66 69 67 2e 73 72 76 } //03 00 \xconfig.srv
|
|
$a_01_2 = {5b 53 68 65 6c 6c 20 61 6c 72 65 61 64 79 20 63 6c 6f 73 65 64 5d } //00 00 [Shell already closed]
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |