20 lines
1.3 KiB
Plaintext
20 lines
1.3 KiB
Plaintext
|
|
rule Worm_Win32_Esfury_V{
|
|
meta:
|
|
description = "Worm:Win32/Esfury.V,SIGNATURE_TYPE_PEHSTR_EXT,08 00 07 00 0a 00 00 05 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {28 48 ff 01 00 6c 68 ff 6c 10 00 04 30 ff 0a 00 00 10 00 04 30 ff fd fe 2c ff 0b 01 00 04 00 f4 08 a9 e7 04 1c ff 0a 02 00 08 00 04 1c ff fb ef } //01 00
|
|
$a_01_1 = {53 00 59 00 6d 00 6c 00 67 00 6a 00 6d 00 66 00 55 00 } //01 00
|
|
$a_01_2 = {59 00 6d 00 6c 00 67 00 6a 00 6d 00 66 00 26 00 61 00 66 00 5e 00 } //01 00
|
|
$a_01_3 = {6b 00 60 00 5d 00 64 00 64 00 54 00 67 00 68 00 5d 00 66 00 35 00 47 00 68 00 5d 00 66 00 } //01 00
|
|
$a_01_4 = {6f 00 61 00 66 00 60 00 5d 00 64 00 68 00 2b 00 2a 00 26 00 5d 00 70 00 5d 00 } //01 00
|
|
$a_01_5 = {4e 00 3d 00 4a 00 4b 00 41 00 47 00 46 00 26 00 4c 00 50 00 4c 00 } //01 00
|
|
$a_01_6 = {54 00 6b 00 71 00 6b 00 6c 00 5d 00 65 00 2b 00 2a 00 54 00 6a 00 6d 00 66 00 5c 00 64 00 64 00 2b 00 2a 00 26 00 5d 00 70 00 5d 00 } //01 00
|
|
$a_01_7 = {3c 00 5d 00 6b 00 63 00 6c 00 67 00 68 00 26 00 61 00 66 00 61 00 } //01 00
|
|
$a_01_8 = {4b 00 25 00 29 00 25 00 31 00 25 00 28 00 29 00 25 00 2b 00 2f 00 2b 00 31 00 31 00 2f 00 2f 00 2c 00 28 00 29 00 25 00 } //01 00
|
|
$a_01_9 = {54 00 3b 00 6d 00 6a 00 6a 00 5d 00 66 00 6c 00 4e 00 5d 00 6a 00 6b 00 61 00 67 00 66 00 54 00 4a 00 6d 00 66 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |