08e8d462fe
RED PILL 🔴 💊
15 lines
No EOL
432 B
Text
15 lines
No EOL
432 B
Text
rule Lightweight_Backdoor_5
|
|
|
|
{
|
|
|
|
meta:
|
|
author = "US CERT"
|
|
reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
|
|
|
|
strings:
|
|
$strl = { C6 45 F4 74 C6 45 F5 6C C6 45 F6 76 C6 45 F7 63 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'tlvc.nls' being moved to ebp
|
|
|
|
condition:
|
|
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
|
|
|
|
} |