11 lines
397 B
Text
11 lines
397 B
Text
rule goziv3: trojan {
|
|
meta:
|
|
module = "goziv3"
|
|
reference = "https://research.checkpoint.com/2020/gozi-the-malware-with-a-thousand-faces/"
|
|
strings:
|
|
$dec_bss = {D3 C0 83 F3 01 89 02 83 C2 04 FF 4C 24 0C}
|
|
$gen_serpent = {33 44 24 04 33 44 24 08 C2 08 00}
|
|
condition:
|
|
($dec_bss and $gen_serpent) and (uint16(0) == 0x5A4D or uint16(0) == 0x5850 )
|
|
}
|
|
|