16 lines
1.2 KiB
Text
16 lines
1.2 KiB
Text
|
rule Mozart
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
author = "Nick Hoffman - Morphick Inc"
|
||
|
|
description = "Detects samples of the Mozart POS RAM scraping utility"
|
||
|
|
strings:
|
||
|
|
$pdb = "z:\\Slender\\mozart\\mozart\\Release\\mozart.pdb" nocase wide ascii
|
||
|
|
$output = {67 61 72 62 61 67 65 2E 74 6D 70 00}
|
||
|
|
$service_name = "NCR SelfServ Platform Remote Monitor" nocase wide ascii
|
||
|
|
$service_name_short = "NCR_RemoteMonitor"
|
||
|
|
$encode_data = {B8 08 10 00 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 55 8B AC 24 14 10 00 00 89 84 24 0C 10 00 00 56 8B C5 33 F6 33 DB 8D 50 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C2 89 44 24 0C ?? ?? 8B 94 24 1C 10 00 00 57 8B FD 2B FA 89 7C 24 10 ?? ?? 8B 7C 24 10 8A 04 17 02 86 E0 BA 40 00 88 02 B8 ?? ?? ?? ?? 46 8D 78 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C7 3B F0 ?? ?? 33 F6 8B C5 43 42 8D 78 01 8A 08 40 84 C9 ?? ?? 2B C7 3B D8 ?? ?? 5F 8B B4 24 1C 10 00 00 8B C5 C6 04 33 00 8D 50 01 8A 08 40 84 C9 ?? ?? 8B 8C 24 20 10 00 00 2B C2 51 8D 54 24 14 52 50 56 E8 ?? ?? ?? ?? 83 C4 10 8B D6 5E 8D 44 24 0C 8B C8 5D 2B D1 5B 8A 08 88 0C 02 40 84 C9 ?? ?? 8B 8C 24 04 10 00 00 E8 ?? ?? ?? ?? 81 C4 08 10 00 00}
|
||
|
|
condition:
|
||
|
|
any of ($pdb, $output, $encode_data) or
|
||
|
|
all of ($service*)
|
||
|
|
}
|