42 lines
937 B
Text
42 lines
937 B
Text
|
private rule SafeNetCode : SafeNet Family
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "SafeNet code features"
|
||
|
|
author = "Seth Hardy"
|
||
|
|
last_modified = "2014-07-16"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
// add edi, 14h; cmp edi, 50D0F8h
|
||
|
|
$ = { 83 C7 14 81 FF F8 D0 40 00 }
|
||
|
|
condition:
|
||
|
|
any of them
|
||
|
|
}
|
||
|
|
|
||
|
|
private rule SafeNetStrings : SafeNet Family
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "Strings used by SafeNet"
|
||
|
|
author = "Seth Hardy"
|
||
|
|
last_modified = "2014-07-16"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr"
|
||
|
|
$ = "/safe/record.php"
|
||
|
|
$ = "_Rm.bat" wide ascii
|
||
|
|
$ = "try\x0d\x0a\x09\x09\x09\x09 del %s" wide ascii
|
||
|
|
$ = "Ext.org" wide ascii
|
||
|
|
|
||
|
|
condition:
|
||
|
|
any of them
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
rule SafeNet : Family
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "SafeNet family"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
SafeNetCode or SafeNetStrings
|
||
|
|
|
||
|
|
}
|