28 lines
4.0 KiB
Plaintext
28 lines
4.0 KiB
Plaintext
|
|
rule Worm_Win32_VB{
|
|
meta:
|
|
description = "Worm:Win32/VB,SIGNATURE_TYPE_PEHSTR,ffffffee 02 ffffffe4 02 12 00 00 fffffff4 01 "
|
|
|
|
strings :
|
|
$a_01_0 = {5c 00 4c 00 75 00 63 00 6b 00 79 00 5c 00 4d 00 79 00 20 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 5c 00 56 00 69 00 73 00 75 00 61 00 6c 00 20 00 42 00 61 00 73 00 69 00 63 00 20 00 36 00 2e 00 30 00 5c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 65 00 72 00 5c 00 77 00 6f 00 72 00 6d 00 32 00 30 00 30 00 37 00 2e 00 76 00 62 00 70 00 } //64 00 \Lucky\My Document\Visual Basic 6.0\Downloader\worm2007.vbp
|
|
$a_01_1 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 72 00 61 00 70 00 69 00 64 00 6e 00 65 00 77 00 73 00 2e 00 6f 00 72 00 67 00 2f 00 77 00 6f 00 72 00 6d 00 32 00 30 00 30 00 37 00 2e 00 65 00 78 00 65 00 } //64 00 http://rapidnews.org/worm2007.exe
|
|
$a_01_2 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 78 00 6d 00 61 00 73 00 34 00 75 00 2e 00 6e 00 65 00 74 00 2f 00 75 00 70 00 64 00 61 00 74 00 65 00 2e 00 64 00 61 00 74 00 } //64 00 http://www.xmas4u.net/update.dat
|
|
$a_01_3 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 36 00 34 00 2e 00 32 00 36 00 2e 00 32 00 35 00 2e 00 37 00 35 00 2f 00 7a 00 69 00 6e 00 2e 00 65 00 78 00 65 00 } //0a 00 http://64.26.25.75/zin.exe
|
|
$a_01_4 = {74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 69 00 6d 00 20 00 66 00 69 00 72 00 65 00 66 00 6f 00 78 00 2e 00 65 00 78 00 65 00 } //0a 00 taskkill /im firefox.exe
|
|
$a_01_5 = {6c 00 73 00 61 00 73 00 73 00 2e 00 65 00 78 00 65 00 } //0a 00 lsass.exe
|
|
$a_01_6 = {4d 00 53 00 63 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 65 00 78 00 65 00 } //0a 00 MSconfig.exe
|
|
$a_01_7 = {6f 00 70 00 65 00 6e 00 3d 00 62 00 6f 00 6f 00 74 00 2e 00 65 00 78 00 65 00 } //0a 00 open=boot.exe
|
|
$a_01_8 = {73 00 68 00 65 00 6c 00 6c 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 3d 00 62 00 6f 00 6f 00 74 00 2e 00 65 00 78 00 65 00 } //0a 00 shellexecute=boot.exe
|
|
$a_01_9 = {73 00 68 00 65 00 6c 00 6c 00 5c 00 41 00 75 00 74 00 6f 00 5c 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 3d 00 62 00 6f 00 6f 00 74 00 2e 00 65 00 78 00 65 00 } //0a 00 shell\Auto\command=boot.exe
|
|
$a_01_10 = {4e 00 65 00 77 00 20 00 46 00 6f 00 6c 00 64 00 65 00 72 00 2e 00 65 00 78 00 65 00 } //0a 00 New Folder.exe
|
|
$a_01_11 = {75 00 73 00 65 00 72 00 69 00 6e 00 69 00 74 00 2e 00 65 00 78 00 65 00 } //0a 00 userinit.exe
|
|
$a_01_12 = {50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 20 00 46 00 69 00 72 00 65 00 66 00 6f 00 78 00 5c 00 66 00 69 00 72 00 65 00 66 00 6f 00 78 00 2e 00 65 00 78 00 65 00 } //0a 00 Program Files\Mozilla Firefox\firefox.exe
|
|
$a_01_13 = {57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 70 00 63 00 68 00 65 00 61 00 6c 00 74 00 68 00 5c 00 68 00 65 00 6c 00 70 00 63 00 74 00 72 00 5c 00 62 00 69 00 6e 00 61 00 72 00 69 00 65 00 73 00 5c 00 6d 00 73 00 63 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 65 00 78 00 65 00 } //0a 00 WINDOWS\pchealth\helpctr\binaries\msconfig.exe
|
|
$a_01_14 = {5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 72 00 65 00 73 00 74 00 6f 00 72 00 65 00 5c 00 72 00 73 00 74 00 72 00 75 00 69 00 2e 00 65 00 78 00 65 00 } //0a 00 \system32\restore\rstrui.exe
|
|
$a_01_15 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 59 00 61 00 68 00 6f 00 6f 00 5c 00 70 00 61 00 67 00 65 00 72 00 5c 00 56 00 69 00 65 00 77 00 5c 00 59 00 4d 00 53 00 47 00 52 00 5f 00 62 00 75 00 7a 00 7a 00 } //0a 00 Software\Yahoo\pager\View\YMSGR_buzz
|
|
$a_01_16 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 59 00 61 00 68 00 6f 00 6f 00 5c 00 70 00 61 00 67 00 65 00 72 00 5c 00 56 00 69 00 65 00 77 00 5c 00 59 00 4d 00 53 00 47 00 52 00 5f 00 4c 00 61 00 75 00 6e 00 63 00 68 00 63 00 61 00 73 00 74 00 } //0a 00 Software\Yahoo\pager\View\YMSGR_Launchcast
|
|
$a_01_17 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 } //00 00 DisableTaskMgr
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |