Sneed-Reactivity/yara-mikesxrs/g00dv1n/Adware.Conduit.yar

37 lines
970 B
Text
Raw Normal View History

rule ConduitASample
{
meta:
Description = "Adware.Conduit.A.vb"
ThreatLevel = "5"
strings:
$ = "GetSpeedBrowserInstalled" ascii wide
$ = "SpeedBrowserAlreadyInstalled" ascii wide
$ = "Injekt SVN - client" ascii wide
condition:
any of them
}
rule ConduitBSample
{
meta:
Description = "Adware.Conduit.B.vb"
ThreatLevel = "5"
strings:
$ = "CAboutTabsInjector_" ascii wide
$ = "AboutTabsDataUrlPublisher" ascii wide
$ = "AboutTabsDataUrlConduit" ascii wide
$ = "AboutTabsUsageUrl" ascii wide
$ = "AboutTabsEnabledByUser" ascii wide
$ = "AboutTabsEnabledByConduit" ascii wide
$ = "AboutTabsEnabledByPublisher" ascii wide
$ = "SearchInNewTabContent.xml" ascii wide
$ = "CONDUIT_CHEVRON_MUTEX" ascii wide
$ = "CConduitExternalForTBAPI" ascii wide
$ = "EI_Toolbar_Update_Mutex" ascii wide
condition:
any of them
}