21 lines
450 B
Text
21 lines
450 B
Text
|
rule W97M_Vawtrak_dropper
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
author="McAfee"
|
||
|
|
description="W97M_Vawtrak_Dropper"
|
||
|
|
reference = "https://securingtomorrow.mcafee.com/mcafee-labs/w97m-downloader-serving-vawtrak/"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$asterismal="asterismal"
|
||
|
|
$bootlicking="bootlicking"
|
||
|
|
$shell="WScript.Shell"
|
||
|
|
$temp="%temp%"
|
||
|
|
$oxygon="oxygon.exe"
|
||
|
|
$saxhorn = "saxhorn"
|
||
|
|
$fire = "Fire"
|
||
|
|
$bin= "546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
all of them
|
||
|
|
}
|