19 lines
1.1 KiB
Plaintext
19 lines
1.1 KiB
Plaintext
|
|
rule Backdoor_Win32_PcClient_DT{
|
|
meta:
|
|
description = "Backdoor:Win32/PcClient.DT,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 02 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {59 c6 44 24 90 01 01 41 c6 44 24 90 01 01 4e c6 44 24 90 01 01 47 8b 54 24 90 01 01 8d 8e 90 01 02 00 00 c6 86 90 01 02 00 00 00 89 86 90 01 02 00 00 c6 44 24 90 01 01 5a c6 44 24 90 01 01 53 90 00 } //02 00
|
|
$a_03_1 = {47 c6 44 24 90 01 01 68 c6 44 24 90 01 01 30 c6 44 24 90 01 01 73 8b 54 24 90 01 01 8d 8e 90 01 02 00 00 89 86 90 01 02 00 00 b0 74 90 00 } //02 00
|
|
$a_03_2 = {68 58 02 00 00 50 51 ff 15 90 01 02 01 10 80 bc 24 90 01 02 00 00 05 0f 85 90 01 02 00 00 8a 84 24 90 01 02 00 00 84 c0 74 0a 3a c3 0f 85 90 01 02 00 00 eb 08 90 00 } //01 00
|
|
$a_01_3 = {75 70 66 69 6c 65 6f 6b 00 } //01 00
|
|
$a_01_4 = {75 70 66 69 6c 65 65 72 00 } //01 00
|
|
$a_01_5 = {74 72 61 66 69 6c 65 00 } //01 00 牴晡汩e
|
|
$a_01_6 = {53 76 63 48 6f 73 74 2e 44 4c 4c 2e 6c 6f 67 00 } //01 00
|
|
$a_01_7 = {5c 7e 53 65 72 76 65 72 2e 64 6c 6c 00 } //01 00
|
|
$a_01_8 = {5c 7e 53 43 6d 64 2e 74 78 74 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |