14 lines
1.5 KiB
Plaintext
14 lines
1.5 KiB
Plaintext
|
|
rule VirTool_Win32_Hitijekt_B_MTB{
|
|
meta:
|
|
description = "VirTool:Win32/Hitijekt.B!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_02_0 = {f2 48 0f 2c c8 48 03 c8 48 8b c1 48 8b 8d 10 01 00 00 48 89 01 48 8b 85 10 01 00 00 48 8b 00 48 d1 e0 48 89 85 d8 00 00 00 ff 15 90 01 04 48 8b 8d d8 00 00 00 4c 8b c1 ba 08 00 00 00 48 8b c8 ff 15 90 01 04 48 89 45 08 48 83 7d 08 00 90 00 } //01 00
|
|
$a_02_1 = {48 8b 85 98 01 00 00 48 89 85 b8 01 00 00 48 8b 85 b8 01 00 00 48 63 40 3c 48 8b 8d 98 01 00 00 48 03 c8 48 8b c1 48 89 85 d8 01 00 00 b8 08 00 00 00 48 6b c0 00 48 8b 95 98 01 00 00 48 8b 8d d8 01 00 00 8b 8c 01 88 00 00 00 e8 90 01 04 8b c0 48 8b 8d 98 01 00 00 48 03 c8 48 8b c1 48 89 85 f8 01 00 00 48 8b 85 f8 01 00 00 8b 40 18 89 85 14 02 00 00 8b 45 04 ff c0 90 00 } //01 00
|
|
$a_02_2 = {48 63 85 c4 02 00 00 48 6b c0 38 48 8b 0d ab 50 01 00 8b 44 01 18 39 85 e4 02 00 00 0f 8d 90 01 04 48 8b 85 68 05 00 00 48 8b 8d 88 01 00 00 48 8d 90 01 02 48 89 85 38 05 00 00 48 8b 85 88 01 00 00 48 ff c0 48 89 85 88 01 00 00 48 8b 85 a8 02 00 00 41 b8 02 00 00 00 48 8b 95 38 05 00 00 48 8b c8 e8 90 01 04 48 63 85 c4 02 00 00 48 6b c0 38 48 63 8d e4 02 00 00 48 8b 15 3c 50 01 00 48 8b 44 02 08 48 8b 0c c8 e8 90 00 } //01 00
|
|
$a_02_3 = {48 c7 45 08 00 00 00 00 48 c7 45 28 00 00 00 00 48 c7 45 48 00 00 00 00 48 c7 45 68 00 00 00 00 b8 08 00 00 00 48 6b c0 01 48 8d 90 01 02 48 8b 8d 18 02 00 00 48 8b 0c 01 e8 90 01 04 48 89 85 88 00 00 00 48 83 bd 88 00 00 00 00 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |