19 lines
340 B
Text
19 lines
340 B
Text
|
rule DarkComet : rat
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "DarkComet"
|
||
|
|
author = "Jean-Philippe Teissier / @Jipe_"
|
||
|
|
date = "2013-01-12"
|
||
|
|
filetype = "memory"
|
||
|
|
version = "1.0"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$a = "#BEGIN DARKCOMET DATA --"
|
||
|
|
$b = "#EOF DARKCOMET DATA --"
|
||
|
|
$c = "DC_MUTEX-"
|
||
|
|
$k1 = "#KCMDDC5#-890"
|
||
|
|
$k2 = "#KCMDDC51#-890"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
any of them
|
||
|
|
}
|