16 lines
No EOL
518 B
Text
16 lines
No EOL
518 B
Text
rule BackdoorDediprosA
|
|
{
|
|
meta:
|
|
Description = "Backdoor.Dedipros.rc"
|
|
ThreatLevel = "5"
|
|
|
|
strings:
|
|
$ = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/advapi32.dll" ascii wide
|
|
$ = "rundll32.exe %s, CodeMain lpServiceName" ascii wide
|
|
$ = "C:\\Windows\\System32\\Rundlla.dll" ascii wide
|
|
$ = "s%\\pmeT\\SWODNIW\\:C" ascii wide
|
|
$ = "SYSTEM\\CurrentControlSet\\Services\\%s" ascii wide
|
|
$ = "\\keylog.dat" ascii wide
|
|
condition:
|
|
2 of them
|
|
} |