28 lines
707 B
Text
28 lines
707 B
Text
|
private rule EzcobStrings : Ezcob Family
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "Ezcob Identifying Strings"
|
||
|
|
author = "Seth Hardy"
|
||
|
|
last_modified = "2014-06-23"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12"
|
||
|
|
$ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12"
|
||
|
|
$ = "Ezcob" wide ascii
|
||
|
|
$ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126"
|
||
|
|
$ = "20110113144935"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
any of them
|
||
|
|
}
|
||
|
|
|
||
|
|
rule Ezcob : Family
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "Ezcob"
|
||
|
|
author = "Seth Hardy"
|
||
|
|
last_modified = "2014-06-23"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
EzcobStrings
|
||
|
|
}
|