14 lines
No EOL
523 B
Text
14 lines
No EOL
523 B
Text
rule turla_dropper
|
|
{
|
|
meta:
|
|
Malware = "Trojan.Turla dropper"
|
|
author = "Symantec"
|
|
reference = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
|
|
|
|
strings:
|
|
$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
|
|
$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 2E 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
|
|
|
|
condition:
|
|
all of them
|
|
} |