14 lines
400 B
Text
14 lines
400 B
Text
rule Adwind
|
|
{
|
|
meta:
|
|
author="Asaf Aprozper, asafa AT minerva-labs.com"
|
|
description = "Adwind RAT"
|
|
last modified = "2017-06-25"
|
|
reference = "https://minerva-labs.com/post/adwind-and-other-evasive-java-rats"
|
|
strings:
|
|
$a0 = "META-INF/MANIFEST.MF"
|
|
$a1 = /Main(\$)Q[0-9][0-9][0-9][0-9]/
|
|
$PK = "PK"
|
|
condition:
|
|
$PK at 0 and $a0 and $a1
|
|
}
|