19 lines
No EOL
512 B
Text
19 lines
No EOL
512 B
Text
rule Destructive_Target_Cleaning_Tool_6
|
|
|
|
{
|
|
meta:
|
|
|
|
author = "US CERT"
|
|
reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
|
|
|
|
strings:
|
|
|
|
$MCU_INF_StartHexDec = "{010346080A30D63633000B6263750A5052322A00103D1B570A30E67F2A00130952690A50 3A0D2A000E00A26El5104556766572636C7669642E657865}"
|
|
|
|
$MCU_INF_StartHexEnc = "{6C3272386958BF075230780A0A54676166024968790C7A6779588F5E47312739310163615B3D59686721CF5F2120263ElF5413531FlE004543544C55}"
|
|
|
|
condition:
|
|
|
|
$MCU_INF_StartHexEnc or $MCU_INF_StartHexDec
|
|
|
|
} |