13 lines
591 B
Plaintext
13 lines
591 B
Plaintext
|
|
rule VirTool_WinNT_Rootkit_A{
|
|
meta:
|
|
description = "VirTool:WinNT/Rootkit.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_00_0 = {61 67 6f 6e 79 20 72 6f 6f 74 6b 69 74 } //01 00 agony rootkit
|
|
$a_01_1 = {25 73 20 2d 70 20 70 72 6f 63 65 73 73 2e 65 78 65 20 20 20 20 20 3a 20 68 69 64 65 20 74 68 65 20 70 72 6f 63 65 73 73 } //01 00 %s -p process.exe : hide the process
|
|
$a_03_2 = {89 44 24 10 c7 44 24 0c 16 00 00 00 c7 44 24 08 90 01 04 c7 44 24 04 dc ff 22 00 8b 45 ec 89 04 24 e8 90 01 04 83 ec 20 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |