35 lines
2.3 KiB
Plaintext
35 lines
2.3 KiB
Plaintext
|
|
rule TrojanDownloader_O97M_Donoff_RK_MTB{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Donoff.RK!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {53 68 65 6c 6c 20 28 59 67 62 63 6a 39 29 } //01 00
|
|
$a_01_1 = {43 68 72 57 28 33 32 29 20 26 20 43 68 72 57 28 31 30 34 29 20 26 20 43 68 72 57 28 31 31 36 29 20 26 20 43 68 72 57 28 31 31 36 29 20 26 20 43 68 72 57 28 31 31 32 29 20 26 20 43 68 72 57 28 35 38 29 20 26 20 43 68 72 57 28 34 37 29 20 26 20 43 68 72 57 28 34 37 29 20 26 20 43 68 72 57 28 39 38 29 20 26 20 43 68 72 57 28 31 30 35 29 } //01 00
|
|
$a_01_2 = {43 68 72 57 28 31 30 32 29 20 26 20 43 68 72 57 28 31 31 36 29 20 26 20 43 68 72 57 28 33 32 29 20 26 20 43 68 72 57 28 39 37 29 20 26 20 43 68 72 57 28 34 36 29 20 26 20 43 68 72 57 28 31 30 30 29 20 26 20 43 68 72 57 28 31 30 38 29 20 26 20 43 68 72 57 28 31 30 38 29 20 26 20 43 68 72 57 28 33 32 29 20 26 20 43 68 72 57 28 33 38 29 } //01 00
|
|
$a_01_3 = {41 75 74 6f 45 78 65 63 28 29 } //00 00
|
|
$a_00_4 = {8f 41 01 } //00 0e
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
}
|
|
rule TrojanDownloader_O97M_Donoff_RK_MTB_2{
|
|
meta:
|
|
description = "TrojanDownloader:O97M/Donoff.RK!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,0e 00 0e 00 0a 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {44 69 6d 20 73 74 4a 38 4d 67 67 20 41 73 20 53 74 72 69 6e 67 } //01 00
|
|
$a_01_1 = {44 69 6d 20 52 57 75 79 63 51 49 20 41 73 20 53 74 72 69 6e 67 } //01 00
|
|
$a_01_2 = {44 69 6d 20 56 70 35 49 58 44 47 20 41 73 20 53 74 72 69 6e 67 } //01 00
|
|
$a_01_3 = {44 69 6d 20 58 6f 62 66 33 79 20 41 73 20 53 74 72 69 6e 67 } //01 00
|
|
$a_01_4 = {44 69 6d 20 77 61 55 57 4d 68 20 41 73 20 53 74 72 69 6e 67 } //01 00
|
|
$a_01_5 = {44 69 6d 20 4d 78 74 76 52 38 31 20 41 73 20 53 74 72 69 6e 67 } //01 00
|
|
$a_01_6 = {44 69 6d 20 78 77 5a 44 4c 47 6f 20 41 73 20 53 74 72 69 6e 67 } //01 00
|
|
$a_01_7 = {44 69 6d 20 5a 45 32 6e 62 72 7a 20 41 73 20 53 74 72 69 6e 67 } //01 00
|
|
$a_01_8 = {44 69 6d 20 59 67 62 63 6a 39 20 41 73 20 53 74 72 69 6e 67 } //05 00
|
|
$a_01_9 = {59 67 62 63 6a 39 20 3d 20 73 74 4a 38 4d 67 67 20 2b 20 52 57 75 79 63 51 49 20 2b 20 56 70 35 49 58 44 47 20 2b 20 58 6f 62 66 33 79 20 2b 20 77 61 55 57 4d 68 20 2b 20 4d 78 74 76 52 38 31 20 2b 20 78 77 5a 44 4c 47 6f 20 2b 20 5a 45 32 6e 62 72 7a } //00 00
|
|
$a_00_10 = {cf 18 00 00 46 9d 24 94 f4 9e } //16 02
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |