16 lines
No EOL
359 B
Text
16 lines
No EOL
359 B
Text
rule CrowdStrike_PutterPanda_06 : xor_dropper putterpanda
|
|
{
|
|
meta:
|
|
description = "PUTTER PANDA - XOR based dropper"
|
|
date = "2014-03-30"
|
|
version = "1.0"
|
|
in_the_wild = true
|
|
copyright = "CrowdStrike, Inc."
|
|
actor = "PUTTER PANDA"
|
|
|
|
strings:
|
|
$xorloop = { 8b d0 83 e2 0f 8a 54 14 04 30 14 01 83 c0 01 3b c6 7c ed }
|
|
|
|
condition:
|
|
$xorloop
|
|
} |