13 lines
772 B
Plaintext
13 lines
772 B
Plaintext
|
|
rule Trojan_MacOS_E2E_CmdLineTest{
|
|
meta:
|
|
description = "Trojan:MacOS/E2E_CmdLineTest,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0a 00 03 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_00_0 = {6d 00 61 00 63 00 6f 00 73 00 5f 00 6d 00 61 00 6c 00 77 00 61 00 72 00 65 00 } //0a 00
|
|
$a_00_1 = {61 00 61 00 64 00 36 00 30 00 31 00 66 00 37 00 2d 00 64 00 37 00 36 00 64 00 2d 00 34 00 64 00 64 00 63 00 2d 00 61 00 62 00 31 00 65 00 2d 00 33 00 37 00 61 00 62 00 34 00 63 00 33 00 65 00 37 00 65 00 36 00 66 00 } //08 00
|
|
$a_00_2 = {61 00 62 00 63 00 39 00 64 00 63 00 34 00 62 00 2d 00 30 00 64 00 66 00 61 00 2d 00 34 00 32 00 66 00 33 00 2d 00 62 00 62 00 63 00 31 00 2d 00 64 00 66 00 66 00 38 00 64 00 65 00 39 00 36 00 30 00 39 00 37 00 37 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |