22 lines
487 B
Text
22 lines
487 B
Text
|
rule ElectroRAT
|
||
|
|
{
|
||
|
|
strings:
|
||
|
|
$str1 = "registerUser.go"
|
||
|
|
$str2 = "osinfo.go"
|
||
|
|
$str3 = "machineid.go"
|
||
|
|
$str4 = "downloadFile.go"
|
||
|
|
$str5 = "hidefile_windows.go"
|
||
|
|
$str6 = "systemcl.go"
|
||
|
|
$str7 = "bin_linux.go"
|
||
|
|
$str8 = "processKill.go"
|
||
|
|
$str9 = "screenshot.go"
|
||
|
|
$str10 = "uploadFolder.go"
|
||
|
|
$str11 = "bin_windows.go"
|
||
|
|
$str12 = "mdworker.go"
|
||
|
|
$str13 = "bin_darwin.go"
|
||
|
|
$str14 = "hidefile.go"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
3 of them
|
||
|
|
}
|