43 lines
773 B
Text
43 lines
773 B
Text
|
private rule HTMLVariant : FakeM Family HTML Variant
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "Identifier for html variant of FAKEM"
|
||
|
|
author = "Katie Kleemola"
|
||
|
|
last_updated = "2014-05-20"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
// decryption loop
|
||
|
|
$s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 }
|
||
|
|
//mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F
|
||
|
|
$s2 = { C6 45 F? (3?|4?) }
|
||
|
|
|
||
|
|
condition:
|
||
|
|
$s1 and #s2 == 16
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
//todo: need rules for other variants
|
||
|
|
rule FakeM : Family
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "FakeM"
|
||
|
|
author = "Katie Kleemola"
|
||
|
|
last_updated = "2014-07-03"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
HTMLVariant
|
||
|
|
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
rule FAKEMhtml : Variant
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "Rule for just the HTML Variant"
|
||
|
|
author = "Katie Kleemola"
|
||
|
|
last_updated = "2014-07-10"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
HTMLVariant
|
||
|
|
}
|