15 lines
No EOL
564 B
Text
15 lines
No EOL
564 B
Text
rule apt_equation_doublefantasy_genericresource {
|
|
meta:
|
|
copyright = "Kaspersky Lab"
|
|
description = "Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW"
|
|
version = "1.0"
|
|
last_modified = "2015-02-16"
|
|
reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
|
|
strings:
|
|
$mz="MZ"
|
|
$a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00}
|
|
$a2="yyyyyyyyyyyyyyyy"
|
|
$a3="002"
|
|
condition:
|
|
(($mz at 0) and all of ($a*)) and filesize < 500000
|
|
} |