20 lines
649 B
Text
20 lines
649 B
Text
|
rule sakula_v3_0
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "Sakula v3.0"
|
||
|
|
date = "2015-10-13"
|
||
|
|
author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
|
||
|
|
reference = "http://blog.airbuscybersecurity.com/post/2015/10/Malware-Sakula-Evolutions-%28Part-2/2%29"
|
||
|
|
strings:
|
||
|
|
$m1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
|
||
|
|
$m2 = "ry.db"
|
||
|
|
$m3 = "cmd.exe /c reg add %s\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v \"%s\" /t REG_SZ /d \"%s\""
|
||
|
|
$m4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
|
||
|
|
|
||
|
|
$MZ = "MZ"
|
||
|
|
condition:
|
||
|
|
$MZ at 0 and all of them
|
||
|
|
}
|
||
|
|
|
||
|
|
|