22 lines
2.6 KiB
Plaintext
22 lines
2.6 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Obfuse_EV{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Obfuse.EV,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 0c 00 00 02 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {43 72 65 61 74 65 90 02 01 20 90 02 10 20 2b 20 90 02 25 20 2b 20 90 00 } //01 00
|
|
$a_03_1 = {47 65 74 4f 62 6a 65 63 74 28 90 02 10 28 22 77 69 22 29 20 2b 20 22 6e 6d 67 6d 74 73 3a 57 69 6e 33 32 5f 50 72 6f 63 65 22 20 2b 20 22 73 73 22 29 29 90 00 } //01 00
|
|
$a_03_2 = {47 65 74 4f 62 6a 65 63 74 28 90 02 10 28 22 77 69 22 29 20 2b 20 90 02 10 28 22 6e 6d 67 6d 74 22 29 20 2b 20 22 73 3a 57 69 6e 33 32 5f 50 72 6f 63 65 22 20 2b 20 22 73 73 22 29 29 90 00 } //01 00
|
|
$a_03_3 = {47 65 74 4f 62 6a 65 63 74 28 90 02 10 28 22 77 69 22 29 20 2b 20 90 02 10 28 22 6e 6d 67 6d 74 22 29 20 2b 20 22 73 3a 57 69 6e 33 22 20 2b 20 90 02 10 28 22 32 5f 50 72 6f 63 65 22 29 20 2b 20 90 02 10 28 22 73 73 22 29 29 29 90 00 } //01 00
|
|
$a_01_4 = {2b 20 43 56 61 72 28 22 6e 6d 67 6d 74 22 29 20 2b 20 22 73 3a 57 69 6e 33 22 20 2b 20 5f } //01 00 + CVar("nmgmt") + "s:Win3" + _
|
|
$a_01_5 = {47 65 74 4f 62 6a 65 63 74 28 43 56 61 72 28 22 77 69 6e 6d 67 6d 74 73 3a 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 22 29 29 29 } //01 00 GetObject(CVar("winmgmts:Win32_Process")))
|
|
$a_01_6 = {47 65 74 4f 62 6a 65 63 74 28 43 56 61 72 28 22 77 69 6e 6d 67 6d 74 73 3a 22 20 2b 20 22 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 22 29 29 29 } //01 00 GetObject(CVar("winmgmts:" + "Win32_Process")))
|
|
$a_01_7 = {47 65 74 4f 62 6a 65 63 74 28 28 22 77 69 6e 6d 22 20 2b 20 22 67 6d 74 73 3a 22 20 2b 20 22 57 69 6e 33 32 5f 50 72 6f 63 22 20 2b 20 22 65 73 73 53 22 20 2b 20 22 74 61 72 74 75 70 22 29 29 } //01 00 GetObject(("winm" + "gmts:" + "Win32_Proc" + "essS" + "tartup"))
|
|
$a_01_8 = {47 65 74 4f 62 6a 65 63 74 28 28 22 77 69 6e 6d 22 20 2b 20 22 67 6d 74 73 3a 22 20 2b 20 22 57 69 6e 22 20 2b 20 22 33 32 5f 50 72 6f 63 22 20 2b 20 22 65 73 73 53 22 20 2b 20 22 74 61 72 74 75 70 22 29 29 } //01 00 GetObject(("winm" + "gmts:" + "Win" + "32_Proc" + "essS" + "tartup"))
|
|
$a_01_9 = {3d 20 47 65 74 4f 62 6a 65 63 74 28 22 57 69 4e 22 20 2b 20 22 6d 67 6d 74 73 3a 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 53 74 61 72 54 55 50 22 29 } //01 00 = GetObject("WiN" + "mgmts:Win32_ProcessStarTUP")
|
|
$a_01_10 = {3d 20 47 65 74 4f 62 6a 65 63 74 28 22 57 69 4e 22 20 2b 20 22 4d 67 4d 74 73 3a 77 22 20 2b 20 22 49 6e 33 32 5f 50 52 6f 63 45 73 73 53 74 41 72 54 75 50 22 29 } //01 00 = GetObject("WiN" + "MgMts:w" + "In32_PRocEssStArTuP")
|
|
$a_03_11 = {53 68 6f 77 57 69 6e 64 6f 77 20 3d 20 90 02 14 20 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |