17 lines
374 B
Text
17 lines
374 B
Text
|
rule EclipseSunCloudRAT
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
author = "AlienVault Labs"
|
||
|
|
info = "CommentCrew-threat-apt1"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$a = "Eclipse_A" wide ascii
|
||
|
|
$b = "\\PJTS\\" wide ascii
|
||
|
|
$c = "Eclipse_Client_B.pdb" wide ascii
|
||
|
|
$d = "XiaoME" wide ascii
|
||
|
|
$e = "SunCloud-Code" wide ascii
|
||
|
|
$f = "/uc_server/data/forum.asp" wide ascii
|
||
|
|
|
||
|
|
condition:
|
||
|
|
any of them
|
||
|
|
}
|