27 lines
546 B
Text
27 lines
546 B
Text
|
rule BLACKMOON_BANKER {
|
||
|
|
|
||
|
|
meta:
|
||
|
|
|
||
|
|
author = "Proofpoint Staff"
|
||
|
|
|
||
|
|
info = "blackmoon update"
|
||
|
|
|
||
|
|
reference = "https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan"
|
||
|
|
|
||
|
|
|
||
|
|
strings:
|
||
|
|
|
||
|
|
$s1 = "BlackMoon RunTime Error:" nocase wide ascii
|
||
|
|
|
||
|
|
$s2 = "\\system32\\rundll32.exe" wide ascii
|
||
|
|
|
||
|
|
$s3 = "cmd.exe /c ipconfig /flushdns" wide ascii
|
||
|
|
|
||
|
|
$s4 = "\\system32\\drivers\\etc\\hosts.ics" wide ascii
|
||
|
|
|
||
|
|
condition:
|
||
|
|
|
||
|
|
all of them
|
||
|
|
|
||
|
|
}
|