18 lines
2.4 KiB
Plaintext
18 lines
2.4 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Emotet_AVPD_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Emotet.AVPD!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {3a 2f 2f 69 6c 75 6d 69 6e 61 67 75 61 72 61 70 75 61 76 61 2e 63 6f 6d 2e 62 72 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 57 78 69 58 52 51 68 41 56 4c 72 75 41 70 49 65 65 39 35 4b 2f } //01 00 ://iluminaguarapuava.com.br/wp-includes/WxiXRQhAVLruApIee95K/
|
|
$a_01_1 = {3a 2f 2f 77 65 62 6e 65 74 2e 6c 74 64 2e 75 6b 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 31 36 61 75 74 65 35 36 5a 56 72 41 59 52 36 4e 55 4c 34 37 2f } //01 00 ://webnet.ltd.uk/wp-includes/16aute56ZVrAYR6NUL47/
|
|
$a_01_2 = {3a 2f 2f 78 65 62 61 62 61 6e 68 63 68 6f 68 61 6e 67 2e 76 6e 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 74 2f } //01 00 ://xebabanhchohang.vn/wp-content/pt/
|
|
$a_01_3 = {3a 2f 2f 73 69 67 72 61 74 65 63 68 2e 64 65 2f 63 61 72 65 65 72 2f 54 61 55 57 70 6a 45 74 6b 64 4c 5a 33 78 6b 2f } //01 00 ://sigratech.de/career/TaUWpjEtkdLZ3xk/
|
|
$a_01_4 = {3a 2f 2f 77 22 26 22 70 62 22 26 22 69 7a 77 22 26 22 6f 22 26 22 6e 2e 63 22 26 22 6f 22 26 22 6d 2f 46 22 26 22 65 78 22 26 22 4f 4c 22 26 22 32 57 22 26 22 78 30 22 26 22 30 6f 22 26 22 6f 43 22 26 22 66 70 22 26 22 67 4f 22 26 22 77 2f } //01 00 ://w"&"pb"&"izw"&"o"&"n.c"&"o"&"m/F"&"ex"&"OL"&"2W"&"x0"&"0o"&"oC"&"fp"&"gO"&"w/
|
|
$a_01_5 = {3a 2f 2f 77 22 26 22 61 74 22 26 22 65 72 22 26 22 73 67 22 26 22 72 6f 22 26 22 75 70 22 26 22 67 6c 22 26 22 6f 62 22 26 22 61 6c 2e 63 22 26 22 6f 22 26 22 6d 2f 63 22 26 22 67 22 26 22 69 2d 62 22 26 22 69 22 26 22 6e 2f 68 22 26 22 77 43 22 26 22 75 2f } //01 00 ://w"&"at"&"er"&"sg"&"ro"&"up"&"gl"&"ob"&"al.c"&"o"&"m/c"&"g"&"i-b"&"i"&"n/h"&"wC"&"u/
|
|
$a_01_6 = {3a 2f 2f 77 22 26 22 65 62 22 26 22 34 6e 22 26 22 6f 74 22 26 22 68 69 22 26 22 6e 67 2e 63 22 26 22 6f 22 26 22 6d 2f 63 22 26 22 67 22 26 22 69 2d 62 22 26 22 69 22 26 22 6e 2f 4c 22 26 22 41 58 22 26 22 6f 61 22 26 22 41 75 22 26 22 66 75 2f } //01 00 ://w"&"eb"&"4n"&"ot"&"hi"&"ng.c"&"o"&"m/c"&"g"&"i-b"&"i"&"n/L"&"AX"&"oa"&"Au"&"fu/
|
|
$a_01_7 = {3a 2f 2f 77 22 26 22 65 62 22 26 22 6f 6e 22 26 22 65 70 22 26 22 6c 75 22 26 22 73 2e 63 22 26 22 6f 22 26 22 6d 2f 77 22 26 22 70 2d 61 22 26 22 64 6d 22 26 22 69 6e 2f 71 22 26 22 54 48 22 26 22 36 46 22 26 22 54 46 22 26 22 74 34 2f } //00 00 ://w"&"eb"&"on"&"ep"&"lu"&"s.c"&"o"&"m/w"&"p-a"&"dm"&"in/q"&"TH"&"6F"&"TF"&"t4/
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |