13 lines
287 B
Text
13 lines
287 B
Text
|
rule hikit2
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
Author = "Novetta"
|
||
|
|
Reference = "https://www.novetta.com/wp-content/uploads/2014/11/HiKit.pdf"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$magic1 = {8C 24 24 43 2B 2B 22 13 13 13 00}
|
||
|
|
$magic2 = {8A 25 25 42 28 28 20 1C 1C 1C 15 15 15 0E 0E 0E 05 05 05 00}
|
||
|
|
|
||
|
|
condition:
|
||
|
|
$magic1 and $magic2
|
||
|
|
}
|