Sneed-Reactivity/yara-mikesxrs/kevthehermit/ClientMesh.yar

20 lines
507 B
Text
Raw Normal View History

rule ClientMesh
{
meta:
author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/06"
ref = "http://malwareconfig.com/stats/ClientMesh"
family = "torct"
strings:
$string1 = "machinedetails"
$string2 = "MySettings"
$string3 = "sendftppasswords"
$string4 = "sendbrowserpasswords"
$string5 = "arma2keyMass"
$string6 = "keylogger"
/*$conf = {00 00 00 00 00 00 00 00 00 7E}*/
condition:
all of them
}