18 lines
3.1 KiB
Plaintext
18 lines
3.1 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Emotet_AGPD_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Emotet.AGPD!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {3a 2f 2f 6b 22 26 22 65 6c 74 22 26 22 6f 6e 22 26 22 63 6f 22 26 22 6e 73 22 26 22 74 72 22 26 22 75 63 22 26 22 74 69 22 26 22 6f 6e 2e 63 22 26 22 6f 22 26 22 6d 2f 5f 76 22 26 22 74 69 5f 62 69 22 26 22 6e 2f 44 22 26 22 46 4e 22 26 22 6f 72 22 26 22 71 2f } //01 00 ://k"&"elt"&"on"&"co"&"ns"&"tr"&"uc"&"ti"&"on.c"&"o"&"m/_v"&"ti_bi"&"n/D"&"FN"&"or"&"q/
|
|
$a_01_1 = {3a 2f 2f 77 22 26 22 77 22 26 22 77 2e 6a 6f 22 26 22 6e 22 26 22 68 22 26 22 72 61 22 26 22 63 68 2e 63 22 26 22 6f 22 26 22 6d 2f 56 22 26 22 32 2f 35 22 26 22 70 69 22 26 22 73 4e 22 26 22 62 22 26 22 61 72 22 26 22 72 56 22 26 22 6d 2f } //01 00 ://w"&"w"&"w.jo"&"n"&"h"&"ra"&"ch.c"&"o"&"m/V"&"2/5"&"pi"&"sN"&"b"&"ar"&"rV"&"m/
|
|
$a_01_2 = {3a 2f 2f 6a 22 26 22 75 64 22 26 22 79 2e 67 22 26 22 6f 74 22 26 22 63 68 22 26 22 61 68 22 26 22 6f 73 22 26 22 74 69 22 26 22 6e 67 2e 63 22 26 22 6f 22 26 22 6d 2f 77 22 26 22 70 2d 61 22 26 22 64 6d 22 26 22 69 6e 2f 68 22 26 22 4d 5a 22 26 22 74 2f } //01 00 ://j"&"ud"&"y.g"&"ot"&"ch"&"ah"&"os"&"ti"&"ng.c"&"o"&"m/w"&"p-a"&"dm"&"in/h"&"MZ"&"t/
|
|
$a_01_3 = {3a 2f 2f 6a 22 26 22 6f 79 22 26 22 61 61 22 26 22 72 67 22 26 22 65 6e 22 26 22 74 2e 63 22 26 22 6c 2f 61 73 22 26 22 73 65 22 26 22 74 73 2f 41 22 26 22 55 67 22 26 22 47 79 22 26 22 4a 67 22 26 22 72 41 22 26 22 37 47 22 26 22 47 4b 22 26 22 72 6f 22 26 22 51 51 22 26 22 70 2f } //01 00 ://j"&"oy"&"aa"&"rg"&"en"&"t.c"&"l/as"&"se"&"ts/A"&"Ug"&"Gy"&"Jg"&"rA"&"7G"&"GK"&"ro"&"QQ"&"p/
|
|
$a_01_4 = {3a 2f 2f 6c 75 22 26 22 6d 69 6e 65 22 26 22 73 74 68 22 26 22 65 6d 22 26 22 65 73 2e 63 22 26 22 6f 22 26 22 6d 2f 63 22 26 22 6c 6f 22 26 22 6e 65 5f 63 22 26 22 6f 6e 22 26 22 74 72 22 26 22 6f 6c 22 26 22 6c 65 22 26 22 72 2f 62 22 26 22 4b 76 22 26 22 35 4c 22 26 22 45 4c 22 26 22 64 67 22 26 22 7a 47 22 26 22 52 68 22 26 22 74 56 22 26 22 41 69 22 26 22 4a 2f } //01 00 ://lu"&"mine"&"sth"&"em"&"es.c"&"o"&"m/c"&"lo"&"ne_c"&"on"&"tr"&"ol"&"le"&"r/b"&"Kv"&"5L"&"EL"&"dg"&"zG"&"Rh"&"tV"&"Ai"&"J/
|
|
$a_01_5 = {3a 2f 2f 6c 75 22 26 22 7a 79 22 26 22 74 65 22 26 22 78 74 75 22 26 22 72 61 2e 63 22 26 22 6f 22 26 22 6d 2f 6d 22 26 22 61 72 22 26 22 66 69 6e 22 26 22 61 6e 22 26 22 63 65 2f 67 22 26 22 64 77 22 26 22 79 4c 22 26 22 6b 75 2f } //01 00 ://lu"&"zy"&"te"&"xtu"&"ra.c"&"o"&"m/m"&"ar"&"fin"&"an"&"ce/g"&"dw"&"yL"&"ku/
|
|
$a_01_6 = {3a 2f 2f 6d 22 26 22 65 74 22 26 22 61 34 22 26 22 6d 65 22 26 22 64 69 61 22 26 22 2e 63 22 26 22 6f 22 26 22 6d 2f 70 6f 22 26 22 72 74 66 22 26 22 6f 6c 22 26 22 69 6f 22 26 22 32 2f 6f 22 26 22 59 6f 22 26 22 53 54 22 26 22 57 39 22 26 22 66 6f 22 26 22 74 67 2f } //01 00 ://m"&"et"&"a4"&"me"&"dia"&".c"&"o"&"m/po"&"rtf"&"ol"&"io"&"2/o"&"Yo"&"ST"&"W9"&"fo"&"tg/
|
|
$a_01_7 = {3a 2f 2f 6c 22 26 22 69 6e 22 26 22 6b 32 74 22 26 22 68 61 22 26 22 69 2e 63 22 26 22 6f 22 26 22 6d 2f 4c 22 26 22 6f 63 22 26 22 6b 2f 61 22 26 22 5a 4e 22 26 22 6a 2f } //00 00 ://l"&"in"&"k2t"&"ha"&"i.c"&"o"&"m/L"&"oc"&"k/a"&"ZN"&"j/
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |