18 lines
491 B
Text
18 lines
491 B
Text
rule marcher
|
|
{
|
|
meta:
|
|
description = "This rule detects a variant of Marcher"
|
|
sample = "6c15fcdcee665dd38a24931da27b1e16c0b15de832d968bf5891d8e389a32d3e"
|
|
author = "strobostro"
|
|
|
|
strings:
|
|
$a = "com.note.donote" wide
|
|
$b = "Adobe Flash Player" wide
|
|
$c = "Click on Activate button to secure your application" wide
|
|
$d = "Please submit your Verifed buy MasterCard Password" wide
|
|
$e = "Please submit your Verifed buy Visa Password" wide
|
|
|
|
condition:
|
|
$a and any of ($b,$c,$d,$e)
|
|
|
|
}
|