11 lines
341 B
Plaintext
11 lines
341 B
Plaintext
|
|
rule TrojanSpy_BAT_HiveMon_AHV_MTB{
|
|
meta:
|
|
description = "TrojanSpy:BAT/HiveMon.AHV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {a2 25 17 11 0b a2 25 18 16 8c 90 01 01 00 00 01 a2 6f 90 01 03 0a 26 00 de 0d 11 0a 2c 08 11 0a 6f 90 01 03 0a 00 dc 2a 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |