14 lines
492 B
Plaintext
14 lines
492 B
Plaintext
|
|
rule Backdoor_Win32_Onklew_A{
|
|
meta:
|
|
description = "Backdoor:Win32/Onklew.A,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {4f 6e 6c 79 4f 6e 65 4b 65 77 } //01 00 OnlyOneKew
|
|
$a_01_1 = {52 75 6e 55 72 6c 4b 65 77 } //01 00 RunUrlKew
|
|
$a_01_2 = {64 6e 73 63 6b 2e 68 6f 75 73 66 2e 6e 65 74 } //01 00 dnsck.housf.net
|
|
$a_03_3 = {47 53 4e 61 6d 65 3d 90 02 0c 53 79 73 3d 90 02 0c 50 63 4e 61 6d 65 3d 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |