12 lines
361 B
Plaintext
12 lines
361 B
Plaintext
|
|
rule Worm_Win32_Pushbot_SW{
|
|
meta:
|
|
description = "Worm:Win32/Pushbot.SW,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_00_0 = {0f b6 1c 08 0f b6 14 0a 01 d3 89 da 81 e2 00 03 00 00 29 d3 0f b6 04 19 30 04 3e 46 90 00 } //01 00
|
|
$a_01_1 = {6e 65 74 20 73 74 6f 70 20 4d 73 4d 70 53 76 63 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |