Sneed-Reactivity/yara-mikesxrs/g00dv1n/Trojan.Frethog.yar
Sam Sneed 08e8d462fe OMG ISTG PLS WORK
RED PILL 🔴 💊
2024-07-25 12:43:35 -05:00

30 lines
No EOL
843 B
Text

rule TrojanDownloaderWin32Frethog_E_Sample
{
meta:
Description = "Trojan.Frethog.sm"
ThreatLevel = "5"
strings:
$ = "C:\\WINDOWS\\system32\\msvbvm60.dll\\3" ascii wide
$ = "DownLoad File:" ascii wide
$ = "\\system32\\mswinsck.ocx" ascii wide
$ = "http://www.pc918.net/file.txt" ascii wide
$ = "http://www.yswm.net/file.txt" ascii wide
$ = "http://www.v138.net/file.txt" ascii wide
$ = "http://www.v345.net/file.txt" ascii wide
$ = "http://www.ahwm.net/file.txt" ascii wide
$ = "http://user.yswm.net/yswm" ascii wide
$ = "so118config" ascii wide
$ = "http://user.yswm.net" ascii wide
$ = "hide.exe" ascii wide
$ = "\\win.ini" ascii wide
$ = "\\system32\\svchost.exe" ascii wide
$ = "P2P DownFile:" ascii wide
$ = "yswm.runsoft" ascii wide
$ = "\\sys.dat" ascii wide
condition:
4 of them
}