admin/roadwy-DefenderYara
1
0
Fork 0
mirror of https://github.com/roadwy/DefenderYara synced 2026-06-21 14:08:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

update 20250402

Browse Source
This commit is contained in:
roadwy
2025-04-26 22:42:45 +08:00
parent fb11191c85
commit 63fedb45b4
69757 changed files with 1439975 additions and 1417327 deletions
Download Patch File Download Diff File Expand all files Collapse all files
#ALF/TrojanDownloader/_#ALF_TrojanDownloader_O97M_Donoff.yar
+54 -54
View File
@@ -1,55 +1,55 @@
rule _#ALF_TrojanDownloader_O97M_Donoff{
meta:
description = "!#ALF:TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {2e 72 22 20 26 20 22 22 20 26 20 22 74 66 22 } //1 .r" & "" & "tf"
$a_01_1 = {6f 22 20 2b 20 22 72 64 2e 41 70 70 6c 69 63 61 74 69 6f 22 20 2b 20 22 6e 22 20 2b } //1 o" + "rd.Applicatio" + "n" +
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
rule _#ALF_TrojanDownloader_O97M_Donoff_2{
meta:
description = "!#ALF:TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_01_0 = {3d 20 22 2e 56 22 } //1 = ".V"
$a_01_1 = {2b 20 22 42 45 22 } //1 + "BE"
$a_01_2 = {3d 20 45 6e 76 69 72 6f 6e 28 22 54 45 4d 50 22 29 20 26 } //1 = Environ("TEMP") &
$a_01_3 = {68 74 74 70 3a 2f 2f 63 6f 6e 6e 65 63 74 2e 62 75 73 69 6e 65 73 73 68 65 6c 70 61 2d 7a 2e 63 6f 6d 2f 64 61 6e 61 2f 68 6f 6d 65 2e 70 68 70 } //1 http://connect.businesshelpa-z.com/dana/home.php
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3
}
rule _#ALF_TrojanDownloader_O97M_Donoff_3{
meta:
description = "!#ALF:TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {29 20 4d 6f 64 20 32 36 29 20 2b 20 36 35 29 } //1 ) Mod 26) + 65)
$a_01_1 = {20 2d 20 36 35 20 2b 20 } //1 - 65 +
$a_01_2 = {20 26 20 43 68 72 28 28 28 } //1 & Chr(((
$a_01_3 = {43 61 73 65 20 36 35 20 54 6f 20 39 30 } //1 Case 65 To 90
$a_01_4 = {43 61 73 65 20 39 37 20 54 6f 20 31 32 32 } //1 Case 97 To 122
$a_01_5 = {20 2d 20 39 37 20 2b 20 } //1 - 97 +
$a_01_6 = {29 20 4d 6f 64 20 32 36 29 20 2b 20 39 37 29 } //1 ) Mod 26) + 97)
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
rule _#ALF_TrojanDownloader_O97M_Donoff_4{
meta:
description = "!#ALF:TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {43 61 73 65 20 41 73 63 28 22 41 22 29 20 2b 20 31 33 20 54 6f 20 41 73 63 28 22 4d 22 29 20 2b 20 31 33 0d 0a } //1
$a_01_1 = {43 61 73 65 20 41 73 63 28 22 4e 22 29 20 2d 20 31 33 20 54 6f 20 41 73 63 28 22 5a 22 29 20 2d 20 31 33 0d 0a } //1
$a_01_2 = {20 3d 20 31 33 20 2f 20 30 0d 0a } //1
$a_01_3 = {2e 53 70 61 77 6e 49 6e 73 74 61 6e 63 65 5f 0d 0a } //1
$a_01_4 = {2e 53 68 6f 77 57 69 6e 64 6f 77 20 3d 20 30 } //1 .ShowWindow = 0
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule _#ALF_TrojanDownloader_O97M_Donoff{
meta:
description = "!#ALF:TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {2e 72 22 20 26 20 22 22 20 26 20 22 74 66 22 } //1 .r" & "" & "tf"
$a_01_1 = {6f 22 20 2b 20 22 72 64 2e 41 70 70 6c 69 63 61 74 69 6f 22 20 2b 20 22 6e 22 20 2b } //1 o" + "rd.Applicatio" + "n" +
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
rule _#ALF_TrojanDownloader_O97M_Donoff_2{
meta:
description = "!#ALF:TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_01_0 = {3d 20 22 2e 56 22 } //1 = ".V"
$a_01_1 = {2b 20 22 42 45 22 } //1 + "BE"
$a_01_2 = {3d 20 45 6e 76 69 72 6f 6e 28 22 54 45 4d 50 22 29 20 26 } //1 = Environ("TEMP") &
$a_01_3 = {68 74 74 70 3a 2f 2f 63 6f 6e 6e 65 63 74 2e 62 75 73 69 6e 65 73 73 68 65 6c 70 61 2d 7a 2e 63 6f 6d 2f 64 61 6e 61 2f 68 6f 6d 65 2e 70 68 70 } //1 http://connect.businesshelpa-z.com/dana/home.php
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3
}
rule _#ALF_TrojanDownloader_O97M_Donoff_3{
meta:
description = "!#ALF:TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {29 20 4d 6f 64 20 32 36 29 20 2b 20 36 35 29 } //1 ) Mod 26) + 65)
$a_01_1 = {20 2d 20 36 35 20 2b 20 } //1 - 65 +
$a_01_2 = {20 26 20 43 68 72 28 28 28 } //1 & Chr(((
$a_01_3 = {43 61 73 65 20 36 35 20 54 6f 20 39 30 } //1 Case 65 To 90
$a_01_4 = {43 61 73 65 20 39 37 20 54 6f 20 31 32 32 } //1 Case 97 To 122
$a_01_5 = {20 2d 20 39 37 20 2b 20 } //1 - 97 +
$a_01_6 = {29 20 4d 6f 64 20 32 36 29 20 2b 20 39 37 29 } //1 ) Mod 26) + 97)
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
rule _#ALF_TrojanDownloader_O97M_Donoff_4{
meta:
description = "!#ALF:TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {43 61 73 65 20 41 73 63 28 22 41 22 29 20 2b 20 31 33 20 54 6f 20 41 73 63 28 22 4d 22 29 20 2b 20 31 33 0d 0a } //1
$a_01_1 = {43 61 73 65 20 41 73 63 28 22 4e 22 29 20 2d 20 31 33 20 54 6f 20 41 73 63 28 22 5a 22 29 20 2d 20 31 33 0d 0a } //1
$a_01_2 = {20 3d 20 31 33 20 2f 20 30 0d 0a } //1
$a_01_3 = {2e 53 70 61 77 6e 49 6e 73 74 61 6e 63 65 5f 0d 0a } //1
$a_01_4 = {2e 53 68 6f 77 57 69 6e 64 6f 77 20 3d 20 30 } //1 .ShowWindow = 0
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
#ALF/TrojanDownloader/_#ALF_TrojanDownloader_O97M_Emotet.yar
+12 -12
View File
@@ -1,13 +1,13 @@
rule _#ALF_TrojanDownloader_O97M_Emotet{
meta:
description = "!#ALF:TrojanDownloader:O97M/Emotet,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_03_0 = {41 74 74 72 69 62 75 74 65 20 56 42 5f 4e 61 6d 65 20 3d 20 22 [0-10] 22 0d 0a 53 75 62 20 61 75 74 6f 6f 70 65 6e 28 29 0d 0a 4f 6e 20 45 72 72 6f 72 20 52 65 73 75 6d 65 20 4e 65 78 74 0d 0a 20 20 20 44 69 6d 20 } //1
$a_01_1 = {2e 53 68 6f 77 57 69 6e 64 6f 77 20 3d 20 54 72 75 65 20 41 6e 64 20 46 61 6c 73 65 } //1 .ShowWindow = True And False
$a_03_2 = {2e 43 61 70 74 69 6f 6e 20 2b 20 [0-10] 2e [0-10] 2e 43 61 70 74 69 6f 6e 29 29 29 } //1
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1) >=3
rule _#ALF_TrojanDownloader_O97M_Emotet{
meta:
description = "!#ALF:TrojanDownloader:O97M/Emotet,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_03_0 = {41 74 74 72 69 62 75 74 65 20 56 42 5f 4e 61 6d 65 20 3d 20 22 [0-10] 22 0d 0a 53 75 62 20 61 75 74 6f 6f 70 65 6e 28 29 0d 0a 4f 6e 20 45 72 72 6f 72 20 52 65 73 75 6d 65 20 4e 65 78 74 0d 0a 20 20 20 44 69 6d 20 } //1
$a_01_1 = {2e 53 68 6f 77 57 69 6e 64 6f 77 20 3d 20 54 72 75 65 20 41 6e 64 20 46 61 6c 73 65 } //1 .ShowWindow = True And False
$a_03_2 = {2e 43 61 70 74 69 6f 6e 20 2b 20 [0-10] 2e [0-10] 2e 43 61 70 74 69 6f 6e 29 29 29 } //1
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1) >=3
}
#ASRWin32ApiMacroExclusion/_#ASRWin32ApiMacroExclusion.yar
+3306 -3306
View File
File diff suppressed because it is too large Load Diff
#PUA/Block/_#PUA_Block_2345Cn.yar
+707 -707
View File
File diff suppressed because it is too large Load Diff
#PUA/Block/_#PUA_Block_CoinMiner.yar
+117 -117
View File
@@ -1,118 +1,118 @@
rule _#PUA_Block_CoinMiner{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 00 "
strings :
$a_80_0 = {62 66 67 6d 69 6e 65 72 2e 65 78 65 } //bfgminer.exe 1
$a_80_1 = {73 74 72 61 74 75 6d 5f 74 68 72 65 61 64 } //stratum_thread 1
$a_80_2 = {63 67 6d 69 6e 65 72 5f 70 6f 6f 6c 5f 73 74 61 74 73 } //cgminer_pool_stats 1
$a_80_3 = {63 67 6d 69 6e 65 72 5f 73 74 61 74 73 } //cgminer_stats 1
$a_80_4 = {63 6f 69 6e 62 61 73 65 } //coinbase 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=3
}
rule _#PUA_Block_CoinMiner_2{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 72 79 70 74 6f 6e 6f 74 65 5f 66 6f 72 6d 61 74 5f 75 74 69 6c 73 2e 63 70 70 } //1 cryptonote_format_utils.cpp
$a_01_1 = {53 74 6f 70 20 6d 69 6e 69 6e 67 } //1 Stop mining
$a_01_2 = {6d 69 6e 65 72 5f 63 6f 6e 66 2e 6a 73 6f 6e } //1 miner_conf.json
$a_01_3 = {63 72 79 70 74 6f 6e 6f 74 65 5f 70 72 6f 74 6f 63 6f 6c 5f 68 61 6e 64 6c 65 72 2e 69 6e 6c } //1 cryptonote_protocol_handler.inl
$a_01_4 = {6d 69 6e 65 72 2e 63 70 70 } //1 miner.cpp
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
rule _#PUA_Block_CoinMiner_3{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_01_0 = {71 74 2f 63 72 6f 77 64 63 6f 69 6e 2e 63 70 70 } //1 qt/crowdcoin.cpp
$a_01_1 = {63 72 6f 77 64 63 6f 69 6e 64 2e 70 69 64 } //1 crowdcoind.pid
$a_01_2 = {31 30 42 69 74 63 6f 69 6e 47 55 49 } //1 10BitcoinGUI
$a_01_3 = {32 72 65 63 65 69 76 65 64 50 61 79 6d 65 6e 74 52 65 71 75 65 73 74 28 53 65 6e 64 43 6f 69 6e 73 52 65 63 69 70 69 65 6e 74 29 } //1 2receivedPaymentRequest(SendCoinsRecipient)
$a_01_4 = {32 72 65 63 65 69 76 65 64 55 52 49 28 51 53 74 72 69 6e 67 29 } //1 2receivedURI(QString)
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4
}
rule _#PUA_Block_CoinMiner_4{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {53 4f 4c 56 45 44 20 25 64 20 42 4c 4f 43 4b 25 73 21 } //1 SOLVED %d BLOCK%s!
$a_01_1 = {49 6e 76 61 6c 69 64 20 62 69 74 62 75 72 6e 65 72 2d 76 6f 6c 74 61 67 65 20 25 64 20 6d 75 73 74 20 62 65 20 25 64 6d 76 20 2d 20 25 64 6d 76 } //1 Invalid bitburner-voltage %d must be %dmv - %dmv
$a_01_2 = {63 6f 69 6e 62 61 73 65 74 78 6e } //1 coinbasetxn
$a_01_3 = {43 6f 6e 6e 65 63 74 65 64 20 74 6f 20 6d 75 6c 74 69 70 6c 65 20 70 6f 6f 6c 73 20 77 69 74 68 25 73 20 62 6c 6f 63 6b 20 63 68 61 6e 67 65 20 6e 6f 74 69 66 79 } //1 Connected to multiple pools with%s block change notify
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
rule _#PUA_Block_CoinMiner_5{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 00 "
strings :
$a_01_0 = {55 73 61 67 65 3a 20 6d 69 6e 65 72 64 20 5b 4f 50 54 49 4f 4e 53 5d } //1 Usage: minerd [OPTIONS]
$a_01_1 = {6d 69 6e 65 72 64 20 2d 2d 68 65 6c 70 } //1 minerd --help
$a_01_2 = {63 70 75 6d 69 6e 65 72 } //1 cpuminer
$a_01_3 = {4c 4f 4e 47 50 4f 4c 4c 20 64 65 74 65 63 74 65 64 20 6e 65 77 20 62 6c 6f 63 6b } //1 LONGPOLL detected new block
$a_01_4 = {6d 69 6e 69 6e 67 2e 73 75 62 6d 69 74 } //1 mining.submit
$a_01_5 = {73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f } //1 stratum+tcp://
$a_01_6 = {22 6d 65 74 68 6f 64 22 3a 20 22 6d 69 6e 69 6e 67 2e 73 75 62 73 63 72 69 62 65 22 } //2 "method": "mining.subscribe"
$a_01_7 = {22 6d 65 74 68 6f 64 22 3a 20 22 6d 69 6e 69 6e 67 2e 61 75 74 68 6f 72 69 7a 65 22 } //2 "method": "mining.authorize"
$a_01_8 = {22 61 67 65 6e 74 22 3a 20 22 63 70 75 6d 69 6e 65 72 2d 6d 75 6c 74 69 2f 30 2e 31 22 } //2 "agent": "cpuminer-multi/0.1"
$a_01_9 = {6d 69 6e 69 6e 67 2e 73 65 74 5f 64 69 66 66 69 63 75 6c 74 79 } //1 mining.set_difficulty
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*1) >=3
}
rule _#PUA_Block_CoinMiner_6{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {67 65 6e 65 73 69 73 20 62 6c 6f 63 6b 20 72 65 77 61 72 64 73 } //1 genesis block rewards
$a_01_1 = {46 61 69 6c 65 64 20 74 6f 20 63 6f 6e 73 74 72 75 63 74 20 6d 69 6e 65 72 20 74 78 } //1 Failed to construct miner tx
$a_01_2 = {57 61 6c 6c 65 74 } //1 Wallet
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
rule _#PUA_Block_CoinMiner_7{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR,04 00 03 00 04 00 00 "
strings :
$a_01_0 = {70 6f 6f 6c 73 74 61 74 65 2e 62 69 6e } //1 poolstate.bin
$a_01_1 = {6d 69 6e 65 72 5f 74 78 } //1 miner_tx
$a_01_2 = {67 65 74 77 61 6c 6c 65 74 73 79 6e 63 64 61 74 61 } //1 getwalletsyncdata
$a_01_3 = {77 61 6c 6c 65 74 5f 61 64 64 72 65 73 73 } //1 wallet_address
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3
}
rule _#PUA_Block_CoinMiner_8{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 00 "
strings :
$a_01_0 = {6a 6f 62 5f 69 64 } //1 job_id
$a_01_1 = {77 6f 72 6b 65 72 2d 69 64 } //1 worker-id
$a_01_2 = {22 6e 69 63 65 68 61 73 68 22 3a } //1 "nicehash":
$a_01_3 = {22 70 61 73 73 22 3a 20 22 } //1 "pass": "
$a_01_4 = {22 75 73 65 72 22 3a 20 22 } //1 "user": "
$a_01_5 = {22 75 72 6c 22 3a 20 22 } //1 "url": "
$a_01_6 = {22 64 6f 6e 61 74 65 2d 6f 76 65 72 2d 70 72 6f 78 79 22 3a 20 31 2c } //1 "donate-over-proxy": 1,
$a_01_7 = {63 70 75 2d 61 66 66 69 6e 69 74 79 } //1 cpu-affinity
$a_01_8 = {70 6f 6f 6c 73 } //1 pools
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9
rule _#PUA_Block_CoinMiner{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 00 "
strings :
$a_80_0 = {62 66 67 6d 69 6e 65 72 2e 65 78 65 } //bfgminer.exe 1
$a_80_1 = {73 74 72 61 74 75 6d 5f 74 68 72 65 61 64 } //stratum_thread 1
$a_80_2 = {63 67 6d 69 6e 65 72 5f 70 6f 6f 6c 5f 73 74 61 74 73 } //cgminer_pool_stats 1
$a_80_3 = {63 67 6d 69 6e 65 72 5f 73 74 61 74 73 } //cgminer_stats 1
$a_80_4 = {63 6f 69 6e 62 61 73 65 } //coinbase 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=3
}
rule _#PUA_Block_CoinMiner_2{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 72 79 70 74 6f 6e 6f 74 65 5f 66 6f 72 6d 61 74 5f 75 74 69 6c 73 2e 63 70 70 } //1 cryptonote_format_utils.cpp
$a_01_1 = {53 74 6f 70 20 6d 69 6e 69 6e 67 } //1 Stop mining
$a_01_2 = {6d 69 6e 65 72 5f 63 6f 6e 66 2e 6a 73 6f 6e } //1 miner_conf.json
$a_01_3 = {63 72 79 70 74 6f 6e 6f 74 65 5f 70 72 6f 74 6f 63 6f 6c 5f 68 61 6e 64 6c 65 72 2e 69 6e 6c } //1 cryptonote_protocol_handler.inl
$a_01_4 = {6d 69 6e 65 72 2e 63 70 70 } //1 miner.cpp
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
rule _#PUA_Block_CoinMiner_3{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_01_0 = {71 74 2f 63 72 6f 77 64 63 6f 69 6e 2e 63 70 70 } //1 qt/crowdcoin.cpp
$a_01_1 = {63 72 6f 77 64 63 6f 69 6e 64 2e 70 69 64 } //1 crowdcoind.pid
$a_01_2 = {31 30 42 69 74 63 6f 69 6e 47 55 49 } //1 10BitcoinGUI
$a_01_3 = {32 72 65 63 65 69 76 65 64 50 61 79 6d 65 6e 74 52 65 71 75 65 73 74 28 53 65 6e 64 43 6f 69 6e 73 52 65 63 69 70 69 65 6e 74 29 } //1 2receivedPaymentRequest(SendCoinsRecipient)
$a_01_4 = {32 72 65 63 65 69 76 65 64 55 52 49 28 51 53 74 72 69 6e 67 29 } //1 2receivedURI(QString)
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4
}
rule _#PUA_Block_CoinMiner_4{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {53 4f 4c 56 45 44 20 25 64 20 42 4c 4f 43 4b 25 73 21 } //1 SOLVED %d BLOCK%s!
$a_01_1 = {49 6e 76 61 6c 69 64 20 62 69 74 62 75 72 6e 65 72 2d 76 6f 6c 74 61 67 65 20 25 64 20 6d 75 73 74 20 62 65 20 25 64 6d 76 20 2d 20 25 64 6d 76 } //1 Invalid bitburner-voltage %d must be %dmv - %dmv
$a_01_2 = {63 6f 69 6e 62 61 73 65 74 78 6e } //1 coinbasetxn
$a_01_3 = {43 6f 6e 6e 65 63 74 65 64 20 74 6f 20 6d 75 6c 74 69 70 6c 65 20 70 6f 6f 6c 73 20 77 69 74 68 25 73 20 62 6c 6f 63 6b 20 63 68 61 6e 67 65 20 6e 6f 74 69 66 79 } //1 Connected to multiple pools with%s block change notify
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
rule _#PUA_Block_CoinMiner_5{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 00 "
strings :
$a_01_0 = {55 73 61 67 65 3a 20 6d 69 6e 65 72 64 20 5b 4f 50 54 49 4f 4e 53 5d } //1 Usage: minerd [OPTIONS]
$a_01_1 = {6d 69 6e 65 72 64 20 2d 2d 68 65 6c 70 } //1 minerd --help
$a_01_2 = {63 70 75 6d 69 6e 65 72 } //1 cpuminer
$a_01_3 = {4c 4f 4e 47 50 4f 4c 4c 20 64 65 74 65 63 74 65 64 20 6e 65 77 20 62 6c 6f 63 6b } //1 LONGPOLL detected new block
$a_01_4 = {6d 69 6e 69 6e 67 2e 73 75 62 6d 69 74 } //1 mining.submit
$a_01_5 = {73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f } //1 stratum+tcp://
$a_01_6 = {22 6d 65 74 68 6f 64 22 3a 20 22 6d 69 6e 69 6e 67 2e 73 75 62 73 63 72 69 62 65 22 } //2 "method": "mining.subscribe"
$a_01_7 = {22 6d 65 74 68 6f 64 22 3a 20 22 6d 69 6e 69 6e 67 2e 61 75 74 68 6f 72 69 7a 65 22 } //2 "method": "mining.authorize"
$a_01_8 = {22 61 67 65 6e 74 22 3a 20 22 63 70 75 6d 69 6e 65 72 2d 6d 75 6c 74 69 2f 30 2e 31 22 } //2 "agent": "cpuminer-multi/0.1"
$a_01_9 = {6d 69 6e 69 6e 67 2e 73 65 74 5f 64 69 66 66 69 63 75 6c 74 79 } //1 mining.set_difficulty
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*1) >=3
}
rule _#PUA_Block_CoinMiner_6{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {67 65 6e 65 73 69 73 20 62 6c 6f 63 6b 20 72 65 77 61 72 64 73 } //1 genesis block rewards
$a_01_1 = {46 61 69 6c 65 64 20 74 6f 20 63 6f 6e 73 74 72 75 63 74 20 6d 69 6e 65 72 20 74 78 } //1 Failed to construct miner tx
$a_01_2 = {57 61 6c 6c 65 74 } //1 Wallet
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
rule _#PUA_Block_CoinMiner_7{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR,04 00 03 00 04 00 00 "
strings :
$a_01_0 = {70 6f 6f 6c 73 74 61 74 65 2e 62 69 6e } //1 poolstate.bin
$a_01_1 = {6d 69 6e 65 72 5f 74 78 } //1 miner_tx
$a_01_2 = {67 65 74 77 61 6c 6c 65 74 73 79 6e 63 64 61 74 61 } //1 getwalletsyncdata
$a_01_3 = {77 61 6c 6c 65 74 5f 61 64 64 72 65 73 73 } //1 wallet_address
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3
}
rule _#PUA_Block_CoinMiner_8{
meta:
description = "!#PUA:Block:CoinMiner,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 00 "
strings :
$a_01_0 = {6a 6f 62 5f 69 64 } //1 job_id
$a_01_1 = {77 6f 72 6b 65 72 2d 69 64 } //1 worker-id
$a_01_2 = {22 6e 69 63 65 68 61 73 68 22 3a } //1 "nicehash":
$a_01_3 = {22 70 61 73 73 22 3a 20 22 } //1 "pass": "
$a_01_4 = {22 75 73 65 72 22 3a 20 22 } //1 "user": "
$a_01_5 = {22 75 72 6c 22 3a 20 22 } //1 "url": "
$a_01_6 = {22 64 6f 6e 61 74 65 2d 6f 76 65 72 2d 70 72 6f 78 79 22 3a 20 31 2c } //1 "donate-over-proxy": 1,
$a_01_7 = {63 70 75 2d 61 66 66 69 6e 69 74 79 } //1 cpu-affinity
$a_01_8 = {70 6f 6f 6c 73 } //1 pools
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9
}
#PUA/Block/_#PUA_Block_CoinMiner64.yar
+33 -33
View File
@@ -1,34 +1,34 @@
rule _#PUA_Block_CoinMiner64{
meta:
description = "!#PUA:Block:CoinMiner64,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 "
strings :
$a_01_0 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run
$a_01_1 = {2d 00 2d 00 63 00 70 00 75 00 2d 00 6d 00 61 00 78 00 2d 00 74 00 68 00 72 00 65 00 61 00 64 00 73 00 2d 00 68 00 69 00 6e 00 74 00 20 00 35 00 30 00 20 00 2d 00 72 00 } //1 --cpu-max-threads-hint 50 -r
$a_01_2 = {2d 00 6f 00 20 00 70 00 6f 00 6f 00 6c 00 2e 00 6d 00 69 00 6e 00 65 00 78 00 6d 00 72 00 2e 00 63 00 6f 00 6d 00 3a 00 34 00 34 00 34 00 34 00 20 00 2d 00 75 00 20 00 } //1 -o pool.minexmr.com:4444 -u
$a_01_3 = {65 00 74 00 68 00 65 00 72 00 65 00 75 00 6d 00 2d 00 6d 00 69 00 6e 00 69 00 6e 00 67 00 } //1 ethereum-mining
$a_01_4 = {65 00 74 00 68 00 6d 00 69 00 6e 00 65 00 72 00 2e 00 65 00 78 00 65 00 } //1 ethminer.exe
$a_01_5 = {77 00 61 00 75 00 70 00 64 00 61 00 74 00 33 00 2e 00 65 00 78 00 65 00 } //1 waupdat3.exe
$a_01_6 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 } //1 msiexec.exe
$a_01_7 = {2d 00 50 00 20 00 73 00 74 00 72 00 61 00 74 00 75 00 6d 00 31 00 } //1 -P stratum1
$a_01_8 = {2f 00 78 00 6d 00 72 00 69 00 } //1 /xmri
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9
}
rule _#PUA_Block_CoinMiner64_2{
meta:
description = "!#PUA:Block:CoinMiner64,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 00 "
strings :
$a_01_0 = {64 6f 6e 61 74 65 2e 76 32 2e 78 6d 72 69 67 2e 63 6f 6d } //1 donate.v2.xmrig.com
$a_01_1 = {63 72 79 70 74 6f 6e 69 67 68 74 2d 6d 6f 6e 65 72 6f 76 37 } //1 cryptonight-monerov7
$a_01_2 = {73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f } //1 stratum+tcp://
$a_01_3 = {6e 69 63 65 68 61 73 68 } //1 nicehash
$a_01_4 = {64 6f 6e 61 74 65 2d 6f 76 65 72 2d 70 72 6f 78 79 } //1 donate-over-proxy
$a_01_5 = {7b 22 69 64 22 3a 25 6c 6c 64 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6b 65 65 70 61 6c 69 76 65 64 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 69 64 22 3a 22 25 73 22 7d 7d } //1 {"id":%lld,"jsonrpc":"2.0","method":"keepalived","params":{"id":"%s"}}
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4
rule _#PUA_Block_CoinMiner64{
meta:
description = "!#PUA:Block:CoinMiner64,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 "
strings :
$a_01_0 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run
$a_01_1 = {2d 00 2d 00 63 00 70 00 75 00 2d 00 6d 00 61 00 78 00 2d 00 74 00 68 00 72 00 65 00 61 00 64 00 73 00 2d 00 68 00 69 00 6e 00 74 00 20 00 35 00 30 00 20 00 2d 00 72 00 } //1 --cpu-max-threads-hint 50 -r
$a_01_2 = {2d 00 6f 00 20 00 70 00 6f 00 6f 00 6c 00 2e 00 6d 00 69 00 6e 00 65 00 78 00 6d 00 72 00 2e 00 63 00 6f 00 6d 00 3a 00 34 00 34 00 34 00 34 00 20 00 2d 00 75 00 20 00 } //1 -o pool.minexmr.com:4444 -u
$a_01_3 = {65 00 74 00 68 00 65 00 72 00 65 00 75 00 6d 00 2d 00 6d 00 69 00 6e 00 69 00 6e 00 67 00 } //1 ethereum-mining
$a_01_4 = {65 00 74 00 68 00 6d 00 69 00 6e 00 65 00 72 00 2e 00 65 00 78 00 65 00 } //1 ethminer.exe
$a_01_5 = {77 00 61 00 75 00 70 00 64 00 61 00 74 00 33 00 2e 00 65 00 78 00 65 00 } //1 waupdat3.exe
$a_01_6 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 } //1 msiexec.exe
$a_01_7 = {2d 00 50 00 20 00 73 00 74 00 72 00 61 00 74 00 75 00 6d 00 31 00 } //1 -P stratum1
$a_01_8 = {2f 00 78 00 6d 00 72 00 69 00 } //1 /xmri
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9
}
rule _#PUA_Block_CoinMiner64_2{
meta:
description = "!#PUA:Block:CoinMiner64,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 00 "
strings :
$a_01_0 = {64 6f 6e 61 74 65 2e 76 32 2e 78 6d 72 69 67 2e 63 6f 6d } //1 donate.v2.xmrig.com
$a_01_1 = {63 72 79 70 74 6f 6e 69 67 68 74 2d 6d 6f 6e 65 72 6f 76 37 } //1 cryptonight-monerov7
$a_01_2 = {73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f } //1 stratum+tcp://
$a_01_3 = {6e 69 63 65 68 61 73 68 } //1 nicehash
$a_01_4 = {64 6f 6e 61 74 65 2d 6f 76 65 72 2d 70 72 6f 78 79 } //1 donate-over-proxy
$a_01_5 = {7b 22 69 64 22 3a 25 6c 6c 64 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6b 65 65 70 61 6c 69 76 65 64 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 69 64 22 3a 22 25 73 22 7d 7d } //1 {"id":%lld,"jsonrpc":"2.0","method":"keepalived","params":{"id":"%s"}}
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4
}
#PUA/Block/_#PUA_Block_FusionCore.yar
+165 -165
View File
@@ -1,166 +1,166 @@
rule _#PUA_Block_FusionCore{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_80_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //Fusion.dll 2
$a_80_1 = {42 65 64 65 64 61 66 6f } //Bededafo 1
$a_80_2 = {48 6f 70 75 6b } //Hopuk 1
$a_80_3 = {4d 61 6d 69 72 6f 66 65 70 69 } //Mamirofepi 1
$a_80_4 = {4e 6f 6e 6f 6d 65 } //Nonome 1
$a_80_5 = {50 61 73 65 6b } //Pasek 1
$a_80_6 = {53 6f 6d 6f 70 } //Somop 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=5
}
rule _#PUA_Block_FusionCore_2{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //Fusion.dll 2
$a_80_1 = {64 6c 34 6a 32 69 6c 34 74 64 75 33 6d 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 42 69 67 4e 6f 78 2f 46 75 73 69 6f 6e 2e 7a 69 70 } //dl4j2il4tdu3m.cloudfront.net/BigNox/Fusion.zip 1
$a_80_2 = {73 6c 6f 74 5f 69 6e 73 74 61 6c 6c 5f 6f 66 66 65 72 } //slot_install_offer 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule _#PUA_Block_FusionCore_3{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_80_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //Fusion.dll 2
$a_80_1 = {6e 6f 78 5f 66 75 73 69 6f 6e } //nox_fusion 1
$a_80_2 = {64 6c 34 6a 32 69 6c 34 74 64 75 33 6d 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 42 69 67 4e 6f 78 } //dl4j2il4tdu3m.cloudfront.net/BigNox 2
$a_80_3 = {73 68 6f 77 20 6f 66 66 65 72 } //show offer 1
$a_80_4 = {54 65 6d 70 5c 46 75 73 69 6f 6e 5f 6e 6f 78 } //Temp\Fusion_nox 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*2+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=4
}
rule _#PUA_Block_FusionCore_4{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_02_0 = {64 6c 6c 3a 73 65 74 75 70 3a 66 69 6c 65 73 3a [0-0f] 2e 64 6c 6c } //1
$a_00_1 = {64 6c 6c 3a 66 69 6c 65 73 3a 69 74 64 6f 77 6e 6c 6f 61 64 2e 64 6c 6c } //1 dll:files:itdownload.dll
$a_00_2 = {52 55 4e 52 4b 56 45 52 49 46 59 } //1 RUNRKVERIFY
$a_00_3 = {53 65 74 75 70 4c 64 72 2e 65 78 65 } //1 SetupLdr.exe
$a_00_4 = {75 6e 6b 6e 6f 77 6e 64 6c 6c 2e 70 64 62 } //1 unknowndll.pdb
condition:
((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5
}
rule _#PUA_Block_FusionCore_5{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 00 "
strings :
$a_80_0 = {66 72 65 65 20 66 75 73 69 6e 64 6c 6c 20 73 74 61 72 74 } //free fusindll start 1
$a_80_1 = {46 55 53 5f 49 6e 69 74 44 6c 6c 20 73 74 61 72 74 } //FUS_InitDll start 1
$a_80_2 = {66 75 6e 73 69 6f 6e 5f 64 6c 6c 5f 69 6e 69 74 65 72 72 6f 72 } //funsion_dll_initerror 1
$a_80_3 = {72 65 63 6f 6d 6d 65 6e 64 65 64 20 66 6f 72 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 } //recommended for your computer 1
$a_80_4 = {46 75 73 69 6f 6e 41 50 49 49 6d 70 6c 3a 3a 72 65 6c 65 61 73 65 44 4c 4c } //FusionAPIImpl::releaseDLL 1
$a_80_5 = {6e 65 74 2f 4c 44 50 6c 61 79 65 72 5f 49 43 5f 46 53 2f 46 75 73 69 6f 6e 2e 7a 69 70 } //net/LDPlayer_IC_FS/Fusion.zip 1
$a_80_6 = {46 75 73 69 6f 6e 41 50 49 49 6d 70 6c 20 20 73 68 6f 77 4e 65 78 74 4f 66 66 73 65 72 20 63 61 70 20 25 73 2c 20 64 65 73 63 20 25 73 } //FusionAPIImpl showNextOffser cap %s, desc %s 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=3
}
rule _#PUA_Block_FusionCore_6{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 00 "
strings :
$a_01_0 = {46 55 53 49 4f 4e 49 4e 49 54 49 41 4c 49 5a 45 49 4e 49 54 } //1 FUSIONINITIALIZEINIT
$a_01_1 = {46 55 53 49 4f 4e 49 4e 49 54 49 41 4c 49 5a 45 57 49 5a 41 52 44 } //1 FUSIONINITIALIZEWIZARD
$a_01_2 = {46 55 53 49 4f 4e 53 48 4f 55 4c 44 53 4b 49 50 50 41 47 45 } //1 FUSIONSHOULDSKIPPAGE
$a_01_3 = {46 55 53 49 4f 4e 43 55 52 50 41 47 45 43 48 41 4e 47 45 44 } //1 FUSIONCURPAGECHANGED
$a_01_4 = {46 55 53 49 4f 4e 44 45 49 4e 49 54 49 41 4c 49 5a 45 53 45 54 55 50 } //1 FUSIONDEINITIALIZESETUP
$a_01_5 = {46 55 53 49 4f 4e 53 45 54 4f 46 46 45 52 53 50 41 47 45 42 41 43 4b 47 52 4f 55 4e 44 } //1 FUSIONSETOFFERSPAGEBACKGROUND
$a_01_6 = {46 55 53 49 4f 4e 57 41 49 54 46 4f 52 4f 46 46 45 52 } //1 FUSIONWAITFOROFFER
$a_01_7 = {46 55 53 49 4f 4e 52 45 50 4f 52 54 49 4e 53 54 41 4c 4c 41 54 49 4f 4e 45 52 52 4f 52 } //1 FUSIONREPORTINSTALLATIONERROR
$a_01_8 = {46 55 53 49 4f 4e 47 45 54 4f 46 46 45 52 53 50 52 4f 47 52 45 53 53 } //1 FUSIONGETOFFERSPROGRESS
$a_00_9 = {52 65 63 6f 6d 6d 65 6e 64 65 64 20 66 6f 72 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 } //1 Recommended for your computer
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_00_9 & 1)*1) >=3
}
rule _#PUA_Block_FusionCore_7{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //2 Fusion.dll
$a_01_1 = {46 55 53 5f 53 48 4f 57 4f 46 46 45 52 53 } //2 FUS_SHOWOFFERS
$a_01_2 = {46 55 53 5f 4e 45 58 54 4f 46 46 45 52 } //2 FUS_NEXTOFFER
$a_01_3 = {46 55 53 5f 49 4e 53 54 41 4c 4c 4f 46 46 45 52 53 } //2 FUS_INSTALLOFFERS
$a_01_4 = {46 55 53 5f 53 45 54 4d 41 49 4e 50 52 4f 44 55 43 54 53 54 41 54 55 53 } //2 FUS_SETMAINPRODUCTSTATUS
$a_01_5 = {46 55 53 5f 57 41 49 54 41 4e 44 46 52 45 45 44 4c 4c } //2 FUS_WAITANDFREEDLL
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2) >=6
}
rule _#PUA_Block_FusionCore_8{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 0d 00 00 "
strings :
$a_01_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //1 Fusion.dll
$a_01_1 = {46 72 65 65 4f 66 66 65 72 73 } //1 FreeOffers
$a_01_2 = {47 65 74 4f 66 66 65 72 73 50 72 6f 67 72 65 73 73 } //1 GetOffersProgress
$a_01_3 = {47 65 74 4f 66 66 65 72 73 53 74 61 74 75 73 } //1 GetOffersStatus
$a_01_4 = {48 65 6c 70 65 72 48 69 64 65 49 63 6f 6e } //1 HelperHideIcon
$a_01_5 = {48 65 6c 70 65 72 53 79 6e 63 54 68 72 65 61 64 } //1 HelperSyncThread
$a_01_6 = {49 6e 69 74 4f 66 66 65 72 73 } //1 InitOffers
$a_01_7 = {49 6e 73 74 61 6c 6c 4f 66 66 65 72 73 } //1 InstallOffers
$a_01_8 = {49 73 4c 6f 61 64 65 64 } //1 IsLoaded
$a_01_9 = {4e 65 78 74 4f 66 66 65 72 } //1 NextOffer
$a_01_10 = {53 65 74 4d 61 69 6e 50 72 6f 64 75 63 74 53 74 61 74 75 73 } //1 SetMainProductStatus
$a_01_11 = {53 65 74 4f 66 66 65 72 73 57 69 6e 64 6f 77 } //1 SetOffersWindow
$a_01_12 = {53 68 6f 77 4f 66 66 65 72 73 } //1 ShowOffers
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1) >=13
}
rule _#PUA_Block_FusionCore_9{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 00 "
strings :
$a_01_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //1 Fusion.dll
$a_01_1 = {46 55 53 5f 47 65 74 4f 66 66 65 72 43 61 70 74 69 6f 6e 41 } //1 FUS_GetOfferCaptionA
$a_01_2 = {46 55 53 5f 47 65 74 4f 66 66 65 72 73 50 72 6f 67 72 65 73 73 } //1 FUS_GetOffersProgress
$a_01_3 = {46 55 53 5f 48 69 64 65 4f 66 66 65 72 73 } //1 FUS_HideOffers
$a_01_4 = {46 55 53 5f 49 6e 73 74 61 6c 6c 4f 66 66 65 72 73 } //1 FUS_InstallOffers
$a_01_5 = {46 55 53 5f 4e 65 78 74 4f 66 66 65 72 } //1 FUS_NextOffer
$a_01_6 = {46 55 53 5f 53 65 74 4d 61 69 6e 50 72 6f 64 75 63 74 53 74 61 74 75 73 } //1 FUS_SetMainProductStatus
$a_01_7 = {46 55 53 5f 53 65 74 4f 66 66 65 72 73 57 69 6e 64 6f 77 } //1 FUS_SetOffersWindow
$a_01_8 = {46 55 53 5f 53 68 6f 77 4f 66 66 65 72 73 } //1 FUS_ShowOffers
$a_01_9 = {46 55 53 5f 57 61 69 74 41 6e 64 46 72 65 65 44 6c 6c } //1 FUS_WaitAndFreeDll
$a_01_10 = {46 55 53 5f 57 61 69 74 46 6f 72 4f 66 66 65 72 73 54 6f 42 65 52 65 61 64 79 } //1 FUS_WaitForOffersToBeReady
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11
}
rule _#PUA_Block_FusionCore_10{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 00 "
strings :
$a_01_0 = {46 00 75 00 73 00 69 00 6f 00 6e 00 2e 00 64 00 6c 00 6c 00 } //2 Fusion.dll
$a_01_1 = {5c 00 54 00 65 00 6d 00 70 00 5c 00 46 00 75 00 73 00 69 00 6f 00 6e 00 5f 00 6c 00 64 00 5c 00 } //2 \Temp\Fusion_ld\
$a_01_2 = {73 00 68 00 6f 00 77 00 4f 00 66 00 66 00 65 00 72 00 20 00 65 00 6e 00 64 00 } //2 showOffer end
$a_01_3 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 5f 00 61 00 63 00 63 00 65 00 70 00 74 00 4f 00 66 00 66 00 65 00 72 00 } //1 download_acceptOffer
$a_01_4 = {5a 00 68 00 69 00 5c 00 4c 00 44 00 50 00 6c 00 61 00 79 00 65 00 72 00 } //1 Zhi\LDPlayer
$a_01_5 = {5c 64 6f 77 6e 6c 6f 61 64 65 72 5c 62 69 6e 5c 6c 64 70 6c 61 79 65 72 69 6e 73 74 2e 70 64 62 } //1 \downloader\bin\ldplayerinst.pdb
$a_01_6 = {64 32 6a 61 6e 6c 74 6e 69 63 76 37 75 68 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 4c 44 50 6c 61 79 65 72 } //5 d2janltnicv7uh.cloudfront.net/LDPlayer
$a_01_7 = {57 69 6e 41 70 69 44 65 63 72 79 70 74 46 69 6c 65 46 75 73 69 6f 6e } //2 WinApiDecryptFileFusion
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*5+(#a_01_7 & 1)*2) >=7
rule _#PUA_Block_FusionCore{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_80_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //Fusion.dll 2
$a_80_1 = {42 65 64 65 64 61 66 6f } //Bededafo 1
$a_80_2 = {48 6f 70 75 6b } //Hopuk 1
$a_80_3 = {4d 61 6d 69 72 6f 66 65 70 69 } //Mamirofepi 1
$a_80_4 = {4e 6f 6e 6f 6d 65 } //Nonome 1
$a_80_5 = {50 61 73 65 6b } //Pasek 1
$a_80_6 = {53 6f 6d 6f 70 } //Somop 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=5
}
rule _#PUA_Block_FusionCore_2{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 "
strings :
$a_80_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //Fusion.dll 2
$a_80_1 = {64 6c 34 6a 32 69 6c 34 74 64 75 33 6d 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 42 69 67 4e 6f 78 2f 46 75 73 69 6f 6e 2e 7a 69 70 } //dl4j2il4tdu3m.cloudfront.net/BigNox/Fusion.zip 1
$a_80_2 = {73 6c 6f 74 5f 69 6e 73 74 61 6c 6c 5f 6f 66 66 65 72 } //slot_install_offer 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4
}
rule _#PUA_Block_FusionCore_3{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_80_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //Fusion.dll 2
$a_80_1 = {6e 6f 78 5f 66 75 73 69 6f 6e } //nox_fusion 1
$a_80_2 = {64 6c 34 6a 32 69 6c 34 74 64 75 33 6d 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 42 69 67 4e 6f 78 } //dl4j2il4tdu3m.cloudfront.net/BigNox 2
$a_80_3 = {73 68 6f 77 20 6f 66 66 65 72 } //show offer 1
$a_80_4 = {54 65 6d 70 5c 46 75 73 69 6f 6e 5f 6e 6f 78 } //Temp\Fusion_nox 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*2+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=4
}
rule _#PUA_Block_FusionCore_4{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_02_0 = {64 6c 6c 3a 73 65 74 75 70 3a 66 69 6c 65 73 3a [0-0f] 2e 64 6c 6c } //1
$a_00_1 = {64 6c 6c 3a 66 69 6c 65 73 3a 69 74 64 6f 77 6e 6c 6f 61 64 2e 64 6c 6c } //1 dll:files:itdownload.dll
$a_00_2 = {52 55 4e 52 4b 56 45 52 49 46 59 } //1 RUNRKVERIFY
$a_00_3 = {53 65 74 75 70 4c 64 72 2e 65 78 65 } //1 SetupLdr.exe
$a_00_4 = {75 6e 6b 6e 6f 77 6e 64 6c 6c 2e 70 64 62 } //1 unknowndll.pdb
condition:
((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5
}
rule _#PUA_Block_FusionCore_5{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 00 "
strings :
$a_80_0 = {66 72 65 65 20 66 75 73 69 6e 64 6c 6c 20 73 74 61 72 74 } //free fusindll start 1
$a_80_1 = {46 55 53 5f 49 6e 69 74 44 6c 6c 20 73 74 61 72 74 } //FUS_InitDll start 1
$a_80_2 = {66 75 6e 73 69 6f 6e 5f 64 6c 6c 5f 69 6e 69 74 65 72 72 6f 72 } //funsion_dll_initerror 1
$a_80_3 = {72 65 63 6f 6d 6d 65 6e 64 65 64 20 66 6f 72 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 } //recommended for your computer 1
$a_80_4 = {46 75 73 69 6f 6e 41 50 49 49 6d 70 6c 3a 3a 72 65 6c 65 61 73 65 44 4c 4c } //FusionAPIImpl::releaseDLL 1
$a_80_5 = {6e 65 74 2f 4c 44 50 6c 61 79 65 72 5f 49 43 5f 46 53 2f 46 75 73 69 6f 6e 2e 7a 69 70 } //net/LDPlayer_IC_FS/Fusion.zip 1
$a_80_6 = {46 75 73 69 6f 6e 41 50 49 49 6d 70 6c 20 20 73 68 6f 77 4e 65 78 74 4f 66 66 73 65 72 20 63 61 70 20 25 73 2c 20 64 65 73 63 20 25 73 } //FusionAPIImpl showNextOffser cap %s, desc %s 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=3
}
rule _#PUA_Block_FusionCore_6{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 00 "
strings :
$a_01_0 = {46 55 53 49 4f 4e 49 4e 49 54 49 41 4c 49 5a 45 49 4e 49 54 } //1 FUSIONINITIALIZEINIT
$a_01_1 = {46 55 53 49 4f 4e 49 4e 49 54 49 41 4c 49 5a 45 57 49 5a 41 52 44 } //1 FUSIONINITIALIZEWIZARD
$a_01_2 = {46 55 53 49 4f 4e 53 48 4f 55 4c 44 53 4b 49 50 50 41 47 45 } //1 FUSIONSHOULDSKIPPAGE
$a_01_3 = {46 55 53 49 4f 4e 43 55 52 50 41 47 45 43 48 41 4e 47 45 44 } //1 FUSIONCURPAGECHANGED
$a_01_4 = {46 55 53 49 4f 4e 44 45 49 4e 49 54 49 41 4c 49 5a 45 53 45 54 55 50 } //1 FUSIONDEINITIALIZESETUP
$a_01_5 = {46 55 53 49 4f 4e 53 45 54 4f 46 46 45 52 53 50 41 47 45 42 41 43 4b 47 52 4f 55 4e 44 } //1 FUSIONSETOFFERSPAGEBACKGROUND
$a_01_6 = {46 55 53 49 4f 4e 57 41 49 54 46 4f 52 4f 46 46 45 52 } //1 FUSIONWAITFOROFFER
$a_01_7 = {46 55 53 49 4f 4e 52 45 50 4f 52 54 49 4e 53 54 41 4c 4c 41 54 49 4f 4e 45 52 52 4f 52 } //1 FUSIONREPORTINSTALLATIONERROR
$a_01_8 = {46 55 53 49 4f 4e 47 45 54 4f 46 46 45 52 53 50 52 4f 47 52 45 53 53 } //1 FUSIONGETOFFERSPROGRESS
$a_00_9 = {52 65 63 6f 6d 6d 65 6e 64 65 64 20 66 6f 72 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 } //1 Recommended for your computer
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_00_9 & 1)*1) >=3
}
rule _#PUA_Block_FusionCore_7{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //2 Fusion.dll
$a_01_1 = {46 55 53 5f 53 48 4f 57 4f 46 46 45 52 53 } //2 FUS_SHOWOFFERS
$a_01_2 = {46 55 53 5f 4e 45 58 54 4f 46 46 45 52 } //2 FUS_NEXTOFFER
$a_01_3 = {46 55 53 5f 49 4e 53 54 41 4c 4c 4f 46 46 45 52 53 } //2 FUS_INSTALLOFFERS
$a_01_4 = {46 55 53 5f 53 45 54 4d 41 49 4e 50 52 4f 44 55 43 54 53 54 41 54 55 53 } //2 FUS_SETMAINPRODUCTSTATUS
$a_01_5 = {46 55 53 5f 57 41 49 54 41 4e 44 46 52 45 45 44 4c 4c } //2 FUS_WAITANDFREEDLL
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2) >=6
}
rule _#PUA_Block_FusionCore_8{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 0d 00 00 "
strings :
$a_01_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //1 Fusion.dll
$a_01_1 = {46 72 65 65 4f 66 66 65 72 73 } //1 FreeOffers
$a_01_2 = {47 65 74 4f 66 66 65 72 73 50 72 6f 67 72 65 73 73 } //1 GetOffersProgress
$a_01_3 = {47 65 74 4f 66 66 65 72 73 53 74 61 74 75 73 } //1 GetOffersStatus
$a_01_4 = {48 65 6c 70 65 72 48 69 64 65 49 63 6f 6e } //1 HelperHideIcon
$a_01_5 = {48 65 6c 70 65 72 53 79 6e 63 54 68 72 65 61 64 } //1 HelperSyncThread
$a_01_6 = {49 6e 69 74 4f 66 66 65 72 73 } //1 InitOffers
$a_01_7 = {49 6e 73 74 61 6c 6c 4f 66 66 65 72 73 } //1 InstallOffers
$a_01_8 = {49 73 4c 6f 61 64 65 64 } //1 IsLoaded
$a_01_9 = {4e 65 78 74 4f 66 66 65 72 } //1 NextOffer
$a_01_10 = {53 65 74 4d 61 69 6e 50 72 6f 64 75 63 74 53 74 61 74 75 73 } //1 SetMainProductStatus
$a_01_11 = {53 65 74 4f 66 66 65 72 73 57 69 6e 64 6f 77 } //1 SetOffersWindow
$a_01_12 = {53 68 6f 77 4f 66 66 65 72 73 } //1 ShowOffers
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1) >=13
}
rule _#PUA_Block_FusionCore_9{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 00 "
strings :
$a_01_0 = {46 75 73 69 6f 6e 2e 64 6c 6c } //1 Fusion.dll
$a_01_1 = {46 55 53 5f 47 65 74 4f 66 66 65 72 43 61 70 74 69 6f 6e 41 } //1 FUS_GetOfferCaptionA
$a_01_2 = {46 55 53 5f 47 65 74 4f 66 66 65 72 73 50 72 6f 67 72 65 73 73 } //1 FUS_GetOffersProgress
$a_01_3 = {46 55 53 5f 48 69 64 65 4f 66 66 65 72 73 } //1 FUS_HideOffers
$a_01_4 = {46 55 53 5f 49 6e 73 74 61 6c 6c 4f 66 66 65 72 73 } //1 FUS_InstallOffers
$a_01_5 = {46 55 53 5f 4e 65 78 74 4f 66 66 65 72 } //1 FUS_NextOffer
$a_01_6 = {46 55 53 5f 53 65 74 4d 61 69 6e 50 72 6f 64 75 63 74 53 74 61 74 75 73 } //1 FUS_SetMainProductStatus
$a_01_7 = {46 55 53 5f 53 65 74 4f 66 66 65 72 73 57 69 6e 64 6f 77 } //1 FUS_SetOffersWindow
$a_01_8 = {46 55 53 5f 53 68 6f 77 4f 66 66 65 72 73 } //1 FUS_ShowOffers
$a_01_9 = {46 55 53 5f 57 61 69 74 41 6e 64 46 72 65 65 44 6c 6c } //1 FUS_WaitAndFreeDll
$a_01_10 = {46 55 53 5f 57 61 69 74 46 6f 72 4f 66 66 65 72 73 54 6f 42 65 52 65 61 64 79 } //1 FUS_WaitForOffersToBeReady
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11
}
rule _#PUA_Block_FusionCore_10{
meta:
description = "!#PUA:Block:FusionCore,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 00 "
strings :
$a_01_0 = {46 00 75 00 73 00 69 00 6f 00 6e 00 2e 00 64 00 6c 00 6c 00 } //2 Fusion.dll
$a_01_1 = {5c 00 54 00 65 00 6d 00 70 00 5c 00 46 00 75 00 73 00 69 00 6f 00 6e 00 5f 00 6c 00 64 00 5c 00 } //2 \Temp\Fusion_ld\
$a_01_2 = {73 00 68 00 6f 00 77 00 4f 00 66 00 66 00 65 00 72 00 20 00 65 00 6e 00 64 00 } //2 showOffer end
$a_01_3 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 5f 00 61 00 63 00 63 00 65 00 70 00 74 00 4f 00 66 00 66 00 65 00 72 00 } //1 download_acceptOffer
$a_01_4 = {5a 00 68 00 69 00 5c 00 4c 00 44 00 50 00 6c 00 61 00 79 00 65 00 72 00 } //1 Zhi\LDPlayer
$a_01_5 = {5c 64 6f 77 6e 6c 6f 61 64 65 72 5c 62 69 6e 5c 6c 64 70 6c 61 79 65 72 69 6e 73 74 2e 70 64 62 } //1 \downloader\bin\ldplayerinst.pdb
$a_01_6 = {64 32 6a 61 6e 6c 74 6e 69 63 76 37 75 68 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 4c 44 50 6c 61 79 65 72 } //5 d2janltnicv7uh.cloudfront.net/LDPlayer
$a_01_7 = {57 69 6e 41 70 69 44 65 63 72 79 70 74 46 69 6c 65 46 75 73 69 6f 6e } //2 WinApiDecryptFileFusion
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*5+(#a_01_7 & 1)*2) >=7
}
#PUA/Block/_#PUA_Block_GameHack.yar
+31 -31
View File
@@ -1,32 +1,32 @@
rule _#PUA_Block_GameHack{
meta:
description = "!#PUA:Block:GameHack,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //1 taskkill /f /im explorer.exe
$a_01_1 = {5c 00 56 00 62 00 6c 00 61 00 6b 00 5c 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5c 00 54 00 72 00 69 00 6e 00 69 00 74 00 79 00 57 00 6f 00 6f 00 66 00 5c 00 54 00 72 00 69 00 6e 00 69 00 74 00 79 00 57 00 6f 00 6f 00 66 00 5c 00 42 00 53 00 4f 00 44 00 46 00 69 00 78 00 65 00 64 00 5c 00 76 00 31 00 2e 00 33 00 5c 00 41 00 6e 00 74 00 69 00 44 00 65 00 62 00 75 00 67 00 41 00 4e 00 44 00 62 00 73 00 6f 00 64 00 70 00 72 00 6f 00 74 00 } //1 \Vblak\Desktop\TrinityWoof\TrinityWoof\BSODFixed\v1.3\AntiDebugANDbsodprot
$a_01_2 = {34 00 43 00 68 00 65 00 61 00 74 00 20 00 45 00 6e 00 67 00 69 00 6e 00 65 00 2e 00 65 00 78 00 65 00 } //1 4Cheat Engine.exe
$a_01_3 = {5c 49 4e 46 5c 63 75 6d 34 2e 62 61 74 } //1 \INF\cum4.bat
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
rule _#PUA_Block_GameHack_2{
meta:
description = "!#PUA:Block:GameHack,SIGNATURE_TYPE_PEHSTR,15 00 14 00 09 00 00 "
strings :
$a_01_0 = {68 74 74 70 73 3a 2f 2f 77 65 61 72 65 64 65 76 73 2e 6e 65 74 } //10 https://wearedevs.net
$a_01_1 = {52 65 6c 65 61 73 65 5c 65 78 70 6c 6f 69 74 2d 6d 61 69 6e 2e 70 64 62 } //10 Release\exploit-main.pdb
$a_01_2 = {72 6f 62 6c 6f 78 2e 63 6f 6d } //10 roblox.com
$a_01_3 = {5c 5c 2e 5c 70 69 70 65 5c 57 65 41 72 65 44 65 76 73 50 75 62 6c 69 63 41 50 49 5f 4c 75 61 } //5 \\.\pipe\WeAreDevsPublicAPI_Lua
$a_01_4 = {65 78 70 6c 6f 69 74 2d 6d 61 69 6e 2e 64 6c 6c } //5 exploit-main.dll
$a_01_5 = {72 62 78 61 73 73 65 74 69 64 3a 2f 2f } //5 rbxassetid://
$a_01_6 = {6f 73 2e 65 78 65 63 75 74 65 } //1 os.execute
$a_01_7 = {6f 73 2e 72 65 6d 6f 76 65 } //1 os.remove
$a_01_8 = {6f 73 2e 72 65 6e 61 6d 65 } //1 os.rename
condition:
((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*5+(#a_01_4 & 1)*5+(#a_01_5 & 1)*5+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=20
rule _#PUA_Block_GameHack{
meta:
description = "!#PUA:Block:GameHack,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //1 taskkill /f /im explorer.exe
$a_01_1 = {5c 00 56 00 62 00 6c 00 61 00 6b 00 5c 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5c 00 54 00 72 00 69 00 6e 00 69 00 74 00 79 00 57 00 6f 00 6f 00 66 00 5c 00 54 00 72 00 69 00 6e 00 69 00 74 00 79 00 57 00 6f 00 6f 00 66 00 5c 00 42 00 53 00 4f 00 44 00 46 00 69 00 78 00 65 00 64 00 5c 00 76 00 31 00 2e 00 33 00 5c 00 41 00 6e 00 74 00 69 00 44 00 65 00 62 00 75 00 67 00 41 00 4e 00 44 00 62 00 73 00 6f 00 64 00 70 00 72 00 6f 00 74 00 } //1 \Vblak\Desktop\TrinityWoof\TrinityWoof\BSODFixed\v1.3\AntiDebugANDbsodprot
$a_01_2 = {34 00 43 00 68 00 65 00 61 00 74 00 20 00 45 00 6e 00 67 00 69 00 6e 00 65 00 2e 00 65 00 78 00 65 00 } //1 4Cheat Engine.exe
$a_01_3 = {5c 49 4e 46 5c 63 75 6d 34 2e 62 61 74 } //1 \INF\cum4.bat
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
rule _#PUA_Block_GameHack_2{
meta:
description = "!#PUA:Block:GameHack,SIGNATURE_TYPE_PEHSTR,15 00 14 00 09 00 00 "
strings :
$a_01_0 = {68 74 74 70 73 3a 2f 2f 77 65 61 72 65 64 65 76 73 2e 6e 65 74 } //10 https://wearedevs.net
$a_01_1 = {52 65 6c 65 61 73 65 5c 65 78 70 6c 6f 69 74 2d 6d 61 69 6e 2e 70 64 62 } //10 Release\exploit-main.pdb
$a_01_2 = {72 6f 62 6c 6f 78 2e 63 6f 6d } //10 roblox.com
$a_01_3 = {5c 5c 2e 5c 70 69 70 65 5c 57 65 41 72 65 44 65 76 73 50 75 62 6c 69 63 41 50 49 5f 4c 75 61 } //5 \\.\pipe\WeAreDevsPublicAPI_Lua
$a_01_4 = {65 78 70 6c 6f 69 74 2d 6d 61 69 6e 2e 64 6c 6c } //5 exploit-main.dll
$a_01_5 = {72 62 78 61 73 73 65 74 69 64 3a 2f 2f } //5 rbxassetid://
$a_01_6 = {6f 73 2e 65 78 65 63 75 74 65 } //1 os.execute
$a_01_7 = {6f 73 2e 72 65 6d 6f 76 65 } //1 os.remove
$a_01_8 = {6f 73 2e 72 65 6e 61 6d 65 } //1 os.rename
condition:
((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*5+(#a_01_4 & 1)*5+(#a_01_5 & 1)*5+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=20
}
#PUA/Block/_#PUA_Block_InstallCore.yar
+121 -121
View File
@@ -1,122 +1,122 @@
rule _#PUA_Block_InstallCore{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_02_0 = {89 e2 89 32 b9 ?? ?? ?? ?? 89 ca 68 ?? ?? ?? ?? 5a 31 d1 8b 31 8b d6 31 c2 89 13 81 c1 ?? ?? ?? ?? ba ?? ?? ?? ?? 03 da bf ?? ?? ?? ?? 8b d7 68 ?? ?? ?? ?? 5a 33 fa 31 cf 81 cf ?? ?? ?? ?? 0f 85 ?? ?? ?? ?? c3 } //1
condition:
((#a_02_0 & 1)*1) >=1
}
rule _#PUA_Block_InstallCore_2{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_02_0 = {89 c2 81 c2 ?? ?? ?? ?? ff ca 8b 4a ?? 33 cb 89 0f ba ?? ?? ?? ?? 03 c2 c7 c1 ?? ?? ?? ?? 03 f9 c7 c1 ?? ?? ?? ?? 8b d1 68 ?? ?? ?? ?? 5a 33 ca 31 c1 c7 c6 ?? ?? ?? ?? ba ?? ?? ?? ?? c1 ea ?? 31 d6 29 f1 0f 85 } //1
condition:
((#a_02_0 & 1)*1) >=1
}
rule _#PUA_Block_InstallCore_3{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_80_0 = {49 6e 73 74 61 6c 6c 43 6f 72 65 } //InstallCore 2
$a_80_1 = {49 6e 73 74 61 6c 6c 65 72 20 50 6f 77 65 72 65 64 20 62 79 20 69 6e 73 74 61 6c 6c 63 6f 72 65 2e 63 6f 6d } //Installer Powered by installcore.com 1
$a_80_2 = {74 65 61 6d 40 69 6e 73 74 61 6c 6c 63 6f 72 65 2e 63 6f 6d } //team@installcore.com 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3
}
rule _#PUA_Block_InstallCore_4{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {2f 2f 77 77 77 2e 78 73 34 61 6c 6c 2e 6e 6c 2f 7e 70 65 74 65 72 6e 65 64 2f } ////www.xs4all.nl/~peterned/ 1
$a_80_1 = {2f 2f 72 70 2e 54 61 64 61 6e 61 64 61 6e 65 74 2e 63 6f 6d 2f } ////rp.Tadanadanet.com/ 1
$a_80_2 = {53 50 4f 4e 53 4f 52 45 44 5f 4f 46 46 45 52 3d } //SPONSORED_OFFER= 1
$a_80_3 = {42 55 54 54 4f 4e 5f 49 4e 53 54 41 4c 4c 3d 49 6e 73 74 61 6c 6c 20 4e 6f 77 } //BUTTON_INSTALL=Install Now 1
$a_80_4 = {49 57 65 62 42 72 6f 77 73 65 72 } //IWebBrowser 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_5{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {2f 2f 73 63 69 74 65 72 2e 63 6f 6d 2f 64 6f 63 73 2f 63 6f 6e 74 65 6e 74 2f 73 63 72 69 70 74 2f 53 74 72 65 61 6d 2e 68 74 6d } ////sciter.com/docs/content/script/Stream.htm 1
$a_80_1 = {49 43 30 30 31 2e 52 65 73 6f 75 72 63 65 73 2e 4f 66 66 65 72 50 61 67 65 2e 68 74 6d 6c } //IC001.Resources.OfferPage.html 1
$a_80_2 = {47 65 6e 65 72 69 63 53 65 74 75 70 2e 65 78 65 2e 63 6f 6e 66 69 67 } //GenericSetup.exe.config 1
$a_80_3 = {49 6e 73 74 61 6c 6c 43 61 70 69 74 61 6c } //InstallCapital 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_InstallCore_6{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {44 4f 57 4e 4c 4f 41 44 45 52 5f 4d 4f 44 45 3d 45 58 45 5f 49 4e 4a 45 43 54 45 44 5f 44 41 54 41 } //DOWNLOADER_MODE=EXE_INJECTED_DATA 1
$a_80_1 = {69 72 73 6f 49 73 4f 70 65 72 61 49 6e 73 74 61 6c 6c 65 64 } //irsoIsOperaInstalled 1
$a_80_2 = {49 6e 73 74 61 6c 6c 43 6f 72 65 } //InstallCore 1
$a_80_3 = {63 68 72 6f 6d 65 2e 65 78 65 } //chrome.exe 1
$a_80_4 = {53 6f 66 74 77 61 72 65 5c 4d 61 63 72 6f 6d 65 64 69 61 5c 46 6c 61 73 68 50 6c 61 79 65 72 } //Software\Macromedia\FlashPlayer 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_7{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_80_0 = {6f 73 2e 73 65 63 75 72 65 64 64 6f 77 6e 6c 6f 61 64 63 64 6e 2e 63 6f 6d 2f 53 65 63 75 72 65 64 44 6f 77 6e 6c 6f 61 64 2f } //os.secureddownloadcdn.com/SecuredDownload/ 2
$a_80_1 = {53 48 4f 57 5f 53 50 4f 4e 53 4f 52 45 44 5f 4f 46 46 45 52 } //SHOW_SPONSORED_OFFER 1
$a_80_2 = {53 4b 49 50 5f 4f 46 46 45 52 } //SKIP_OFFER 1
$a_80_3 = {44 45 46 41 55 4c 54 5f 4f 46 52 5f 43 48 45 43 4b 45 52 } //DEFAULT_OFR_CHECKER 1
$a_80_4 = {44 45 46 41 55 4c 54 5f 4f 46 52 5f 4f 4e 5f 46 49 4e 49 53 48 } //DEFAULT_OFR_ON_FINISH 1
$a_80_5 = {4f 70 65 72 61 } //Opera 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_8{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_80_0 = {72 70 2e 63 6f 6f 6c 76 69 64 65 6f 63 6f 6e 76 65 72 74 65 72 2e 63 6f 6d } //rp.coolvideoconverter.com 1
$a_80_1 = {63 64 6e 75 73 2e 63 6f 6f 6c 76 69 64 65 6f 63 6f 6e 76 65 72 74 65 72 2e 63 6f 6d } //cdnus.coolvideoconverter.com 1
$a_80_2 = {53 4b 49 50 5f 4f 46 46 45 52 } //SKIP_OFFER 1
$a_80_3 = {43 48 4f 4f 53 45 5f 44 45 46 41 55 4c 54 5f 4f 46 46 45 52 } //CHOOSE_DEFAULT_OFFER 1
$a_80_4 = {6f 70 65 72 61 70 72 65 66 73 2e 69 6e 69 } //operaprefs.ini 1
$a_80_5 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_6 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=5
}
rule _#PUA_Block_InstallCore_9{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 "
strings :
$a_80_0 = {78 73 34 61 6c 6c 2e 6e 6c 2f 7e 70 65 74 65 72 6e 65 64 2f } //xs4all.nl/~peterned/ 1
$a_80_1 = {72 70 2e 62 61 69 78 61 6b 69 61 6c 74 63 64 6e 32 2e 63 6f 6d 2f } //rp.baixakialtcdn2.com/ 1
$a_80_2 = {44 45 46 41 55 4c 54 5f 4f 46 52 5f 43 4f 44 45 31 3d 64 65 66 61 75 6c 74 4f 66 66 65 72 2f 6f 66 66 65 72 5f 63 6f 64 65 2e 68 74 6d 6c } //DEFAULT_OFR_CODE1=defaultOffer/offer_code.html 1
$a_80_3 = {49 6e 73 74 61 6c 6c 43 6f 72 65 3a 20 76 35 2e 36 36 } //InstallCore: v5.66 1
$a_80_4 = {6f 70 65 72 61 2e 65 78 65 } //opera.exe 1
$a_80_5 = {63 68 72 6f 6d 65 2e 65 78 65 } //chrome.exe 1
$a_80_6 = {54 6f 6f 6c 42 61 72 } //ToolBar 1
$a_80_7 = {54 61 73 6b 62 61 72 43 72 65 61 74 65 64 } //TaskbarCreated 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=8
rule _#PUA_Block_InstallCore{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_02_0 = {89 e2 89 32 b9 ?? ?? ?? ?? 89 ca 68 ?? ?? ?? ?? 5a 31 d1 8b 31 8b d6 31 c2 89 13 81 c1 ?? ?? ?? ?? ba ?? ?? ?? ?? 03 da bf ?? ?? ?? ?? 8b d7 68 ?? ?? ?? ?? 5a 33 fa 31 cf 81 cf ?? ?? ?? ?? 0f 85 ?? ?? ?? ?? c3 } //1
condition:
((#a_02_0 & 1)*1) >=1
}
rule _#PUA_Block_InstallCore_2{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_02_0 = {89 c2 81 c2 ?? ?? ?? ?? ff ca 8b 4a ?? 33 cb 89 0f ba ?? ?? ?? ?? 03 c2 c7 c1 ?? ?? ?? ?? 03 f9 c7 c1 ?? ?? ?? ?? 8b d1 68 ?? ?? ?? ?? 5a 33 ca 31 c1 c7 c6 ?? ?? ?? ?? ba ?? ?? ?? ?? c1 ea ?? 31 d6 29 f1 0f 85 } //1
condition:
((#a_02_0 & 1)*1) >=1
}
rule _#PUA_Block_InstallCore_3{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_80_0 = {49 6e 73 74 61 6c 6c 43 6f 72 65 } //InstallCore 2
$a_80_1 = {49 6e 73 74 61 6c 6c 65 72 20 50 6f 77 65 72 65 64 20 62 79 20 69 6e 73 74 61 6c 6c 63 6f 72 65 2e 63 6f 6d } //Installer Powered by installcore.com 1
$a_80_2 = {74 65 61 6d 40 69 6e 73 74 61 6c 6c 63 6f 72 65 2e 63 6f 6d } //team@installcore.com 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3
}
rule _#PUA_Block_InstallCore_4{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {2f 2f 77 77 77 2e 78 73 34 61 6c 6c 2e 6e 6c 2f 7e 70 65 74 65 72 6e 65 64 2f } ////www.xs4all.nl/~peterned/ 1
$a_80_1 = {2f 2f 72 70 2e 54 61 64 61 6e 61 64 61 6e 65 74 2e 63 6f 6d 2f } ////rp.Tadanadanet.com/ 1
$a_80_2 = {53 50 4f 4e 53 4f 52 45 44 5f 4f 46 46 45 52 3d } //SPONSORED_OFFER= 1
$a_80_3 = {42 55 54 54 4f 4e 5f 49 4e 53 54 41 4c 4c 3d 49 6e 73 74 61 6c 6c 20 4e 6f 77 } //BUTTON_INSTALL=Install Now 1
$a_80_4 = {49 57 65 62 42 72 6f 77 73 65 72 } //IWebBrowser 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_5{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {2f 2f 73 63 69 74 65 72 2e 63 6f 6d 2f 64 6f 63 73 2f 63 6f 6e 74 65 6e 74 2f 73 63 72 69 70 74 2f 53 74 72 65 61 6d 2e 68 74 6d } ////sciter.com/docs/content/script/Stream.htm 1
$a_80_1 = {49 43 30 30 31 2e 52 65 73 6f 75 72 63 65 73 2e 4f 66 66 65 72 50 61 67 65 2e 68 74 6d 6c } //IC001.Resources.OfferPage.html 1
$a_80_2 = {47 65 6e 65 72 69 63 53 65 74 75 70 2e 65 78 65 2e 63 6f 6e 66 69 67 } //GenericSetup.exe.config 1
$a_80_3 = {49 6e 73 74 61 6c 6c 43 61 70 69 74 61 6c } //InstallCapital 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_InstallCore_6{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {44 4f 57 4e 4c 4f 41 44 45 52 5f 4d 4f 44 45 3d 45 58 45 5f 49 4e 4a 45 43 54 45 44 5f 44 41 54 41 } //DOWNLOADER_MODE=EXE_INJECTED_DATA 1
$a_80_1 = {69 72 73 6f 49 73 4f 70 65 72 61 49 6e 73 74 61 6c 6c 65 64 } //irsoIsOperaInstalled 1
$a_80_2 = {49 6e 73 74 61 6c 6c 43 6f 72 65 } //InstallCore 1
$a_80_3 = {63 68 72 6f 6d 65 2e 65 78 65 } //chrome.exe 1
$a_80_4 = {53 6f 66 74 77 61 72 65 5c 4d 61 63 72 6f 6d 65 64 69 61 5c 46 6c 61 73 68 50 6c 61 79 65 72 } //Software\Macromedia\FlashPlayer 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_7{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_80_0 = {6f 73 2e 73 65 63 75 72 65 64 64 6f 77 6e 6c 6f 61 64 63 64 6e 2e 63 6f 6d 2f 53 65 63 75 72 65 64 44 6f 77 6e 6c 6f 61 64 2f } //os.secureddownloadcdn.com/SecuredDownload/ 2
$a_80_1 = {53 48 4f 57 5f 53 50 4f 4e 53 4f 52 45 44 5f 4f 46 46 45 52 } //SHOW_SPONSORED_OFFER 1
$a_80_2 = {53 4b 49 50 5f 4f 46 46 45 52 } //SKIP_OFFER 1
$a_80_3 = {44 45 46 41 55 4c 54 5f 4f 46 52 5f 43 48 45 43 4b 45 52 } //DEFAULT_OFR_CHECKER 1
$a_80_4 = {44 45 46 41 55 4c 54 5f 4f 46 52 5f 4f 4e 5f 46 49 4e 49 53 48 } //DEFAULT_OFR_ON_FINISH 1
$a_80_5 = {4f 70 65 72 61 } //Opera 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=5
}
rule _#PUA_Block_InstallCore_8{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_80_0 = {72 70 2e 63 6f 6f 6c 76 69 64 65 6f 63 6f 6e 76 65 72 74 65 72 2e 63 6f 6d } //rp.coolvideoconverter.com 1
$a_80_1 = {63 64 6e 75 73 2e 63 6f 6f 6c 76 69 64 65 6f 63 6f 6e 76 65 72 74 65 72 2e 63 6f 6d } //cdnus.coolvideoconverter.com 1
$a_80_2 = {53 4b 49 50 5f 4f 46 46 45 52 } //SKIP_OFFER 1
$a_80_3 = {43 48 4f 4f 53 45 5f 44 45 46 41 55 4c 54 5f 4f 46 46 45 52 } //CHOOSE_DEFAULT_OFFER 1
$a_80_4 = {6f 70 65 72 61 70 72 65 66 73 2e 69 6e 69 } //operaprefs.ini 1
$a_80_5 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_6 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=5
}
rule _#PUA_Block_InstallCore_9{
meta:
description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 "
strings :
$a_80_0 = {78 73 34 61 6c 6c 2e 6e 6c 2f 7e 70 65 74 65 72 6e 65 64 2f } //xs4all.nl/~peterned/ 1
$a_80_1 = {72 70 2e 62 61 69 78 61 6b 69 61 6c 74 63 64 6e 32 2e 63 6f 6d 2f } //rp.baixakialtcdn2.com/ 1
$a_80_2 = {44 45 46 41 55 4c 54 5f 4f 46 52 5f 43 4f 44 45 31 3d 64 65 66 61 75 6c 74 4f 66 66 65 72 2f 6f 66 66 65 72 5f 63 6f 64 65 2e 68 74 6d 6c } //DEFAULT_OFR_CODE1=defaultOffer/offer_code.html 1
$a_80_3 = {49 6e 73 74 61 6c 6c 43 6f 72 65 3a 20 76 35 2e 36 36 } //InstallCore: v5.66 1
$a_80_4 = {6f 70 65 72 61 2e 65 78 65 } //opera.exe 1
$a_80_5 = {63 68 72 6f 6d 65 2e 65 78 65 } //chrome.exe 1
$a_80_6 = {54 6f 6f 6c 42 61 72 } //ToolBar 1
$a_80_7 = {54 61 73 6b 62 61 72 43 72 65 61 74 65 64 } //TaskbarCreated 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=8
}
#PUA/Block/_#PUA_Block_KuaiZip.yar
+449 -449
View File
@@ -1,450 +1,450 @@
rule _#PUA_Block_KuaiZip{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 "
strings :
$a_80_0 = {64 6f 77 6e 31 2e 6e 61 6e 6a 69 6e 67 63 68 65 6e 78 69 2e 63 6f 6d } //down1.nanjingchenxi.com 3
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 57 68 69 72 6c 77 69 6e 64 50 64 66 } //Software\WhirlwindPdf 2
condition:
((#a_80_0 & 1)*3+(#a_80_1 & 1)*2) >=5
}
rule _#PUA_Block_KuaiZip_2{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_80_0 = {4b 75 61 69 5a 69 70 } //KuaiZip 1
$a_00_1 = {4b 75 61 69 5a 69 70 2e 4d 61 69 6e 57 6e 64 2e 54 6f 6f 6c 62 61 72 } //1 KuaiZip.MainWnd.Toolbar
$a_80_2 = {57 61 69 74 4f 74 68 65 72 4b 5a 69 70 } //WaitOtherKZip 1
$a_80_3 = {4b 5a 69 70 53 68 65 6c 6c 2e 64 6c 6c } //KZipShell.dll 1
condition:
((#a_80_0 & 1)*1+(#a_00_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=3
}
rule _#PUA_Block_KuaiZip_3{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 "
strings :
$a_80_0 = {6b 70 7a 69 70 2e 63 6f 6d } //kpzip.com 2
$a_80_1 = {4b 75 61 69 5a 69 70 20 53 65 74 75 70 } //KuaiZip Setup 2
$a_80_2 = {53 4f 46 54 57 41 52 45 5c 53 69 63 65 6e 74 } //SOFTWARE\Sicent 1
$a_80_3 = {53 4f 46 54 57 41 52 45 5c 48 69 6e 74 73 6f 66 74 } //SOFTWARE\Hintsoft 1
$a_80_4 = {53 4f 46 54 57 41 52 45 5c 47 6f 79 6f 6f } //SOFTWARE\Goyoo 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_4{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {64 6f 77 6e 31 2e 37 36 35 34 2e 63 6f 6d } //down1.7654.com 1
$a_80_1 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d } //i.kpzip.com 1
$a_80_2 = {6b 75 61 69 79 61 6d 69 6e 69 } //kuaiyamini 1
$a_80_3 = {77 77 77 2e 38 38 79 73 67 2e 63 6f 6d 2f 74 65 6d 70 6c 65 74 73 2f 38 38 79 73 67 2f 63 65 73 68 69 33 2e 68 74 6d } //www.88ysg.com/templets/88ysg/ceshi3.htm 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_5{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {4b 75 61 69 5a 69 70 54 69 70 73 32 } //KuaiZipTips2 1
$a_80_1 = {74 6a 2e 6b 70 7a 69 70 2e 63 6f 6d } //tj.kpzip.com 1
$a_80_2 = {68 61 6f 31 32 33 4a 75 7a 69 2e 65 78 65 } //hao123Juzi.exe 1
$a_80_3 = {61 70 69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 73 68 6f 77 63 6f 75 6e 74 2e 70 68 70 3f 6e 61 6d 65 3d } //api.kpzip.com/showcount.php?name= 1
$a_80_4 = {68 65 69 6e 6f 74 65 } //heinote 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_6{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {2f 2f 72 65 70 6f 72 74 2e 75 63 68 69 68 61 2e 6c 74 64 } ////report.uchiha.ltd 1
$a_80_1 = {64 6f 77 6e 34 2e 37 36 35 34 2e 63 6f 6d } //down4.7654.com 1
$a_80_2 = {64 2e 68 65 69 6e 6f 74 65 2e 63 6f 6d } //d.heinote.com 1
$a_80_3 = {52 65 70 6f 72 74 2e 65 78 65 } //Report.exe 1
$a_80_4 = {73 6f 66 74 77 61 72 65 5c 48 65 69 6e 6f 74 65 5c 72 65 70 6f 72 74 } //software\Heinote\report 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_7{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {6b 75 61 69 79 61 74 69 74 6c 65 } //kuaiyatitle 1
$a_80_1 = {7a 73 72 63 6b 63 67 2e 78 79 7a } //zsrckcg.xyz 1
$a_80_2 = {68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d } //hotnews.dftoutiao.com 1
$a_80_3 = {70 6f 70 6e 61 6d 65 3d 6d 69 6e 69 6e 65 77 73 } //popname=mininews 1
$a_80_4 = {4d 69 6e 69 44 65 62 75 67 65 72 } //MiniDebuger 1
$a_80_5 = {61 64 31 2e 37 36 35 34 2e 63 6f 6d } //ad1.7654.com 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_KuaiZip_8{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {6b 75 61 69 7a 69 70 72 65 70 6f 72 74 2f 6d 69 6e 69 6e 65 77 73 } //kuaizipreport/mininews 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 78 69 61 6f 79 75 5c 52 65 70 6f 72 74 5c 6f 66 66 6c 69 6e 65 } //Software\xiaoyu\Report\offline 1
$a_80_2 = {4b 5a 52 65 70 6f 72 74 2e 65 78 65 } //KZReport.exe 1
$a_80_3 = {53 65 74 50 6f 70 75 70 50 65 72 69 6f 64 } //SetPopupPeriod 1
$a_80_4 = {4d 69 6e 69 6e 65 77 73 54 69 74 6c 65 41 64 73 57 6e 64 } //MininewsTitleAdsWnd 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_9{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {74 69 70 73 2e 6e 61 6e 6a 69 6e 67 63 68 65 6e 78 69 2e 63 6f 6d } //tips.nanjingchenxi.com 1
$a_80_1 = {6b 75 61 69 7a 69 70 } //kuaizip 1
$a_80_2 = {32 33 34 35 63 68 72 6f 6d 65 2e 65 78 65 } //2345chrome.exe 1
$a_80_3 = {33 36 30 53 45 2e 65 78 65 } //360SE.exe 1
$a_80_4 = {6f 70 65 72 61 2e 65 78 65 } //opera.exe 1
$a_80_5 = {32 33 34 35 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //2345explorer.exe 1
$a_80_6 = {71 71 62 72 6f 77 73 65 72 2e 65 78 65 } //qqbrowser.exe 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_10{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {4b 75 61 69 7a 69 70 } //Kuaizip 1
$a_80_1 = {2f 2f 69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 72 65 70 6f 72 74 2f 72 65 70 6f 72 74 2e 74 78 74 } ////i.kpzip.com/n/report/report.txt 1
$a_80_2 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 49 6e 73 74 61 6c 6c } //Software\KuaiZip\Install 1
$a_80_3 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 52 65 70 6f 72 74 5c 49 6e 73 74 61 6c 6c } //Software\KuaiZip\Report\Install 1
$a_80_4 = {4b 5a 52 65 70 6f 72 74 2e 65 78 65 } //KZReport.exe 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_11{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {64 3a 5c 73 76 6e 72 6f 6f 74 5c 6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 4b 7a 55 70 64 61 74 65 41 67 65 6e 63 79 2e 70 64 62 } //d:\svnroot\kuaizip\trunk\bin\Release\X86\KzUpdateAgency.pdb 1
$a_80_1 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 74 75 69 2f 75 70 64 61 74 65 5f 61 67 65 6e 63 79 2f 6b 62 2e 78 6d 6c } //i.kpzip.com/n/tui/update_agency/kb.xml 1
$a_80_2 = {6b 7a 75 70 64 61 74 65 5f 61 67 65 6e 63 79 } //kzupdate_agency 1
$a_80_3 = {4b 75 61 69 5a 69 70 } //KuaiZip 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_12{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_80_0 = {53 6f 66 74 77 61 72 65 5c 37 36 35 34 42 72 6f 77 73 65 72 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 } //Software\7654Browser\UpdateChecker 1
$a_80_1 = {6c 6c 71 30 30 31 5c 73 72 63 5c 6f 75 74 5c 4f 66 66 69 63 69 61 6c 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 2e 65 78 65 2e 70 64 62 } //llq001\src\out\Official\UpdateChecker.exe.pdb 1
$a_80_2 = {65 72 72 2e 6c 6f 67 } //err.log 1
$a_80_3 = {7a 6d 5f 74 6f 6f 6c 73 5c 6d 75 6c 74 69 5f 65 78 65 5c 75 70 64 61 74 65 5f 63 68 65 63 6b 65 72 2e 63 63 } //zm_tools\multi_exe\update_checker.cc 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=3
}
rule _#PUA_Block_KuaiZip_13{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {53 6f 66 74 77 61 72 65 5c 6c 73 7a 69 70 5c 73 75 62 6d 69 74 5c 74 75 72 6e 6f 66 66 } //Software\lszip\submit\turnoff 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 78 69 6e 6e 6f 74 65 5c 72 65 70 6f 72 74 5c 6f 66 66 6c 69 6e 65 } //Software\xinnote\report\offline 1
$a_80_2 = {4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 } //MiniDumpWriteDump 1
$a_80_3 = {54 61 73 6b 62 61 72 43 72 65 61 74 65 64 } //TaskbarCreated 1
$a_80_4 = {53 6f 66 74 77 61 72 65 5c 51 69 6e 67 4a 69 65 50 64 66 5c 52 65 70 6f 72 74 } //Software\QingJiePdf\Report 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_14{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {2f 2f 64 6f 77 6e 31 2e 77 61 6c 6c 70 61 70 65 72 2e 73 68 71 69 6e 67 7a 61 6f 2e 63 6f 6d 2f 72 65 70 6f 72 74 2f 71 75 65 72 79 69 6e 66 6f 2e 78 6d 6c } ////down1.wallpaper.shqingzao.com/report/queryinfo.xml 1
$a_80_1 = {6d 69 6e 6b 65 72 6e 65 6c 5c 63 72 74 73 5c 75 63 72 74 5c 69 6e 63 5c 63 6f 72 65 63 72 74 5f 69 6e 74 65 72 6e 61 6c 5f 73 74 72 74 6f 78 2e 68 } //minkernel\crts\ucrt\inc\corecrt_internal_strtox.h 1
$a_80_2 = {52 65 70 6f 72 74 2e 65 78 65 } //Report.exe 1
$a_80_3 = {53 6f 66 74 77 61 72 65 5c 43 61 6c 66 57 61 6c 6c 70 61 70 65 72 5c 49 6e 73 74 61 6c 6c } //Software\CalfWallpaper\Install 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_15{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d } //i.kpzip.com 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 49 6e 73 74 61 6c 6c } //Software\KuaiZip\Install 1
$a_80_2 = {63 68 72 6f 6d 65 2e 65 78 65 } //chrome.exe 1
$a_80_3 = {6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 2e 70 64 62 } //kuaizip\trunk\bin\Release\X86\UpdateChecker.pdb 1
$a_80_4 = {6f 70 65 72 61 2e 65 78 65 } //opera.exe 1
$a_80_5 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 } //Software\KuaiZip\UpdateChecker 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_KuaiZip_16{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {6d 69 6e 69 6e 65 77 73 2d 68 6e 2e 37 36 35 34 2e 63 6f 6d 2f 6e 2f 74 75 69 2f 77 6b 65 2e 64 6c 6c } //mininews-hn.7654.com/n/tui/wke.dll 1
$a_80_1 = {74 6a 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6b 75 61 69 7a 69 70 72 65 70 6f 72 74 } //tj.kpzip.com/kuaizipreport 1
$a_80_2 = {65 3a 5c 5a 4d 5f 50 72 6f 6a 65 63 74 5c 4b 75 61 69 5a 69 70 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 6d 69 6e 69 6e 65 77 73 2e 70 64 62 } //e:\ZM_Project\KuaiZip\bin\Release\X86\mininews.pdb 1
$a_80_3 = {77 77 77 2e 6b 75 61 69 7a 69 70 2e 63 6f 6d 2f 6d 65 6d 62 65 72 2f 69 6e 64 65 78 2e 70 68 70 } //www.kuaizip.com/member/index.php 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_17{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {64 3a 5c 73 76 6e 72 6f 6f 74 5c 6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 2e 70 64 62 } //d:\svnroot\kuaizip\trunk\bin\Release\X86\UpdateChecker.pdb 2
$a_80_1 = {6c 69 65 62 61 6f 2e 65 78 65 } //liebao.exe 1
$a_80_2 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 75 70 64 61 74 65 63 68 65 63 6b 65 72 2f 6b 62 2e 78 6d 6c } //i.kpzip.com/n/updatechecker/kb.xml 1
$a_80_3 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 49 6e 73 74 61 6c 6c } //Software\KuaiZip\Install 1
$a_80_4 = {6b 75 61 69 7a 69 70 72 65 70 6f 72 74 } //kuaizipreport 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_18{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 00 "
strings :
$a_80_0 = {6b 75 61 69 79 61 } //kuaiya 1
$a_80_1 = {6b 75 61 69 7a 69 70 } //kuaizip 1
$a_80_2 = {57 68 69 72 6c 77 69 6e 64 50 64 66 } //WhirlwindPdf 1
$a_00_3 = {32 33 34 35 63 68 72 6f 6d 65 } //1 2345chrome
$a_00_4 = {74 69 70 73 2e 6e 61 6e 6a 69 6e 67 63 68 65 6e 78 69 2e 63 6f 6d } //1 tips.nanjingchenxi.com
$a_00_5 = {6e 65 77 73 2e 74 6f 75 74 69 61 6f 62 61 73 68 69 2e 63 6f 6d } //1 news.toutiaobashi.com
$a_00_6 = {33 36 30 63 68 72 6f 6d 65 2e 65 78 65 } //1 360chrome.exe
$a_00_7 = {6f 70 65 72 61 2e 65 78 65 } //1 opera.exe
$a_80_8 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_9 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_80_8 & 1)*-100+(#a_80_9 & 1)*-100) >=8
}
rule _#PUA_Block_KuaiZip_19{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {74 70 6f 70 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 74 75 69 2f 74 70 6f 70 2f 74 70 6f 70 34 2f 6b 62 5f 6e 6f 70 6f 70 2e 78 6d 6c } //tpop.kpzip.com/n/tui/tpop/tpop4/kb_nopop.xml 1
$a_80_1 = {64 6f 77 6e 32 2e 37 36 35 34 2e 63 6f 6d } //down2.7654.com 1
$a_80_2 = {65 3a 5c 5a 4d 5f 50 72 6f 6a 65 63 74 5c 4b 75 61 69 5a 69 70 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 74 70 6f 70 34 2e 70 64 62 } //e:\ZM_Project\KuaiZip\bin\Release\X86\tpop4.pdb 1
$a_80_3 = {68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d } //hotnews.dftoutiao.com 1
$a_80_4 = {2f 6b 75 61 69 7a 69 70 72 65 70 6f 72 74 2f 6d 69 6e 69 6e 65 77 73 } ///kuaizipreport/mininews 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_20{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 00 "
strings :
$a_80_0 = {6b 75 61 69 79 61 74 69 74 6c 65 } //kuaiyatitle 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 78 69 6e 6e 6f 74 65 5c 49 6e 73 74 61 6c 6c } //Software\xinnote\Install 1
$a_80_2 = {68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d } //hotnews.dftoutiao.com 1
$a_80_3 = {6e 65 77 73 2e 37 36 35 34 2e 63 6f 6d } //news.7654.com 1
$a_80_4 = {4d 69 6e 69 44 65 62 75 67 65 72 } //MiniDebuger 1
$a_02_5 = {72 00 65 00 70 00 6f 00 72 00 74 00 2e 00 [0-0f] 2e 00 6d 00 75 00 78 00 69 00 6e 00 2e 00 66 00 75 00 6e 00 } //1
$a_02_6 = {72 65 70 6f 72 74 2e [0-0f] 2e 6d 75 78 69 6e 2e 66 75 6e } //1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1) >=6
}
rule _#PUA_Block_KuaiZip_21{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_80_0 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d } //i.kpzip.com 1
$a_80_1 = {5c 4b 75 61 69 5a 69 70 5c 4b 75 61 69 5a 69 70 5f 53 65 74 75 70 2e 65 78 65 } //\KuaiZip\KuaiZip_Setup.exe 1
$a_80_2 = {61 70 69 2e 6b 70 7a 69 70 2e 63 6f 6d } //api.kpzip.com 1
$a_80_3 = {64 3a 5c 73 76 6e 72 6f 6f 74 5c 6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 4b 7a 55 70 64 61 74 65 41 67 65 6e 63 79 2e 70 64 62 } //d:\svnroot\kuaizip\trunk\bin\Release\X86\KzUpdateAgency.pdb 1
$a_80_4 = {6b 7a 75 70 64 61 74 65 61 67 65 6e 63 79 } //kzupdateagency 1
$a_80_5 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_6 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=5
}
rule _#PUA_Block_KuaiZip_22{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {75 73 65 5f 72 75 6e 5f 73 63 72 65 65 6e 73 61 76 65 72 5f 68 6f 74 6b 65 79 } //use_run_screensaver_hotkey 1
$a_00_1 = {53 4f 46 54 57 41 52 45 5c 53 69 63 65 6e 74 } //1 SOFTWARE\Sicent
$a_80_2 = {61 64 5f 62 72 6f 77 73 65 72 5f 65 76 65 6e 74 5f 68 61 6e 64 6c 65 72 } //ad_browser_event_handler 1
$a_00_3 = {53 4f 46 54 57 41 52 45 5c 47 6f 79 6f 6f } //1 SOFTWARE\Goyoo
$a_00_4 = {53 4f 46 54 57 41 52 45 5c 48 69 6e 74 73 6f 66 74 } //1 SOFTWARE\Hintsoft
$a_00_5 = {52 65 6c 65 61 73 65 5f 7a 68 61 6e 5f 6d 65 6e 67 5c 57 69 6e 33 32 5c 73 63 72 65 65 6e 5f 73 61 76 65 72 2e 65 78 65 2e 70 64 62 } //1 Release_zhan_meng\Win32\screen_saver.exe.pdb
$a_80_6 = {53 6f 66 74 77 61 72 65 5c 53 63 72 65 65 6e 53 61 76 65 72 } //Software\ScreenSaver 1
condition:
((#a_80_0 & 1)*1+(#a_00_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_23{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 55 6e 69 6e 73 74 61 6c 6c 5c 4b 75 61 69 5a 69 70 } //SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KuaiZip 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 43 69 74 79 43 68 65 63 6b } //Software\KuaiZip\CityCheck 1
$a_80_2 = {48 65 69 6e 6f 74 65 2e 69 6e 69 } //Heinote.ini 1
$a_80_3 = {2f 2f 61 70 69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 73 68 6f 77 63 6f 75 6e 74 2e 70 68 70 3f 6e 61 6d 65 3d } ////api.kpzip.com/showcount.php?name= 1
$a_80_4 = {2f 2f 6b 79 70 6f 73 69 74 69 6f 6e 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d 2f 70 6f 73 69 74 69 6f 6e 2f 67 65 74 30 32 } ////kyposition.dftoutiao.com/position/get02 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_24{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 00 "
strings :
$a_00_0 = {61 00 62 00 63 00 6b 00 61 00 6e 00 74 00 75 00 2e 00 63 00 6f 00 6d 00 } //2 abckantu.com
$a_00_1 = {72 65 70 6f 72 74 2e 73 63 72 65 65 6e 73 61 76 65 72 73 2e 73 68 7a 68 61 6e 6d 65 6e 67 2e 63 6f 6d } //2 report.screensavers.shzhanmeng.com
$a_00_2 = {64 00 6f 00 77 00 6e 00 32 00 32 00 2e 00 7a 00 6d 00 6d 00 64 00 6e 00 2e 00 63 00 6f 00 6d 00 } //2 down22.zmmdn.com
$a_00_3 = {64 6f 77 6e 2e 78 69 61 6c 64 2e 63 6f 6d } //1 down.xiald.com
$a_80_4 = {53 4f 46 54 57 41 52 45 5c 48 69 6e 74 73 6f 66 74 } //SOFTWARE\Hintsoft 1
$a_80_5 = {53 4f 46 54 57 41 52 45 5c 53 69 63 65 6e 74 } //SOFTWARE\Sicent 1
$a_80_6 = {53 4f 46 54 57 41 52 45 5c 47 6f 79 6f 6f } //SOFTWARE\Goyoo 1
$a_00_7 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 50 00 68 00 6f 00 74 00 6f 00 56 00 69 00 65 00 77 00 65 00 72 00 } //2 Software\PhotoViewer
$a_80_8 = {53 6f 66 74 77 61 72 65 5c 53 63 72 65 65 6e 53 61 76 65 72 } //Software\ScreenSaver 2
condition:
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_00_7 & 1)*2+(#a_80_8 & 1)*2) >=4
}
rule _#PUA_Block_KuaiZip_25{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 00 "
strings :
$a_80_0 = {73 74 61 74 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 73 74 61 74 2f 69 6e 64 65 78 2e 70 68 70 } //stat.kpzip.com/stat/index.php 2
$a_80_1 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 75 70 64 61 74 65 2f 6b 62 2e 78 6d 6c } //i.kpzip.com/n/update/kb.xml 1
$a_80_2 = {6b 7a 55 70 64 61 74 65 2e 43 50 72 6f 6d 70 74 55 70 67 72 61 64 65 2e 53 43 5f 43 4c 4f 53 45 } //kzUpdate.CPromptUpgrade.SC_CLOSE 1
$a_80_3 = {64 3a 5c 73 76 6e 72 6f 6f 74 5c 6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 55 70 64 61 74 65 2e 70 64 62 } //d:\svnroot\kuaizip\trunk\bin\Release\X86\Update.pdb 1
$a_80_4 = {50 65 72 72 79 53 68 61 64 6f 77 57 6e 64 } //PerryShadowWnd 1
$a_80_5 = {4b 7a 55 70 64 61 74 65 2e 65 78 65 } //KzUpdate.exe 1
$a_80_6 = {4b 75 61 69 7a 69 70 53 65 74 75 70 5f } //KuaizipSetup_ 1
$a_80_7 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_8 = {55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 } //Uninstaller.exe -100
$a_80_9 = {55 6e 69 6e 73 74 61 6c 2e 65 78 65 } //Uninstal.exe -100
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100+(#a_80_9 & 1)*-100) >=6
}
rule _#PUA_Block_KuaiZip_26{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 "
strings :
$a_80_0 = {53 6f 66 74 77 61 72 65 5c 43 61 6c 66 57 61 6c 6c 70 61 70 65 72 5c 69 6e 73 74 61 6c 6c } //Software\CalfWallpaper\install 1
$a_02_1 = {43 00 3a 00 5c 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 73 00 20 00 61 00 6e 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 5c 00 [0-0f] 5c 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 44 00 61 00 74 00 61 00 5c 00 43 00 61 00 6c 00 66 00 57 00 61 00 6c 00 6c 00 70 00 61 00 70 00 65 00 72 00 5c 00 } //1
$a_02_2 = {43 3a 5c 44 6f 63 75 6d 65 6e 74 73 20 61 6e 64 20 53 65 74 74 69 6e 67 73 5c [0-0f] 5c 41 70 70 6c 69 63 61 74 69 6f 6e 20 44 61 74 61 5c 43 61 6c 66 57 61 6c 6c 70 61 70 65 72 5c } //1
$a_80_3 = {43 61 6c 66 57 61 6c 6c 70 61 70 65 72 2e 65 78 65 } //CalfWallpaper.exe 1
$a_80_4 = {67 75 61 6e 77 61 6e 67 5f 30 30 31 } //guanwang_001 1
$a_80_5 = {68 74 74 70 3a 2f 2f 72 65 70 6f 72 74 2e 77 61 6c 6c 70 61 70 65 72 2e 73 68 71 69 6e 67 7a 61 6f 2e 63 6f 6d } //http://report.wallpaper.shqingzao.com 1
condition:
((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_27{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 00 "
strings :
$a_01_0 = {53 6f 66 74 77 61 72 65 5c 37 36 35 34 42 72 6f 77 73 65 72 5c } //1 Software\7654Browser\
$a_01_1 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c } //1 Software\KuaiZip\
$a_01_2 = {53 75 5a 69 70 } //1 SuZip
$a_01_3 = {58 75 6e 5a 69 70 } //1 XunZip
$a_01_4 = {6b 70 7a 69 70 2e 63 6f 6d } //1 kpzip.com
$a_01_5 = {37 36 35 34 2e 63 6f 6d 2f 6e 2f 74 75 69 } //1 7654.com/n/tui
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_28{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {74 6a 2e 67 6c 7a 69 70 2e 63 6f 6d } //1 tj.glzip.com
$a_01_1 = {74 6a 31 2e 37 36 35 34 2e 63 6f 6d } //1 tj1.7654.com
$a_01_2 = {78 79 6e 6f 74 65 2e 73 68 7a 68 61 6e 6d 65 6e 67 2e 63 6f 6d } //1 xynote.shzhanmeng.com
$a_01_3 = {6d 69 6e 69 5f 6e 65 77 73 5f 73 6b 69 6e 5f 61 64 2e 64 6c 6c } //1 mini_news_skin_ad.dll
$a_01_4 = {6b 75 61 69 7a 69 70 72 65 70 6f 72 74 } //1 kuaizipreport
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_29{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,03 00 03 00 02 00 00 "
strings :
$a_01_0 = {62 72 61 6e 63 68 65 73 5c 78 69 61 6f 79 75 54 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 57 69 6e 33 32 5c 55 70 67 72 61 64 65 2e 70 64 62 } //2 branches\xiaoyuTrunk\bin\Release\Win32\Upgrade.pdb
$a_01_1 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 78 00 69 00 61 00 6f 00 79 00 75 00 5c 00 55 00 70 00 64 00 61 00 74 00 65 00 43 00 68 00 65 00 63 00 6b 00 65 00 72 00 } //1 Software\xiaoyu\UpdateChecker
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3
}
rule _#PUA_Block_KuaiZip_30{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,07 00 07 00 06 00 00 "
strings :
$a_01_0 = {68 74 74 70 3a 2f 2f 6e 65 77 73 2e 37 36 35 34 2e 63 6f 6d 2f } //2 http://news.7654.com/
$a_01_1 = {7b 38 38 46 36 30 30 41 43 2d 45 36 41 38 2d 34 41 45 31 2d 41 43 46 37 2d 37 33 44 35 43 41 41 44 30 39 34 33 7d } //2 {88F600AC-E6A8-4AE1-ACF7-73D5CAAD0943}
$a_01_2 = {2f 73 6d 61 72 74 6c 6f 6f 6b 2f 70 6f 70 75 70 3f 63 6f 64 65 3d } //2 /smartlook/popup?code=
$a_01_3 = {48 4b 45 59 5f 43 55 52 52 45 4e 54 5f 55 53 45 52 5c 53 6f 66 74 77 61 72 65 5c } //1 HKEY_CURRENT_USER\Software\
$a_01_4 = {37 36 35 34 42 72 6f 77 73 65 72 } //1 7654Browser
$a_01_5 = {4d 69 6e 69 4e 65 77 73 49 6e 66 6f } //1 MiniNewsInfo
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_31{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 53 00 69 00 63 00 65 00 6e 00 74 00 00 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 47 00 6f 00 79 00 6f 00 6f 00 00 00 00 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 48 00 69 00 6e 00 74 00 73 00 6f 00 66 00 74 00 } //3
$a_01_1 = {53 4f 46 54 57 41 52 45 5c 48 65 69 6e 6f 74 65 } //1 SOFTWARE\Heinote
$a_01_2 = {53 6f 66 74 77 61 72 65 5c 78 69 61 6f 79 75 } //1 Software\xiaoyu
$a_01_3 = {68 65 69 6e 6f 74 65 2e 37 36 35 34 2e 63 6f 6d 2f 78 69 65 79 69 2e 68 74 6d 6c } //1 heinote.7654.com/xieyi.html
$a_01_4 = {78 69 61 6f 79 75 2e 73 68 7a 68 61 6e 6d 65 6e 67 2e 63 6f 6d 2f 6c 6f 67 6f } //1 xiaoyu.shzhanmeng.com/logo
condition:
((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule _#PUA_Block_KuaiZip{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 "
strings :
$a_80_0 = {64 6f 77 6e 31 2e 6e 61 6e 6a 69 6e 67 63 68 65 6e 78 69 2e 63 6f 6d } //down1.nanjingchenxi.com 3
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 57 68 69 72 6c 77 69 6e 64 50 64 66 } //Software\WhirlwindPdf 2
condition:
((#a_80_0 & 1)*3+(#a_80_1 & 1)*2) >=5
}
rule _#PUA_Block_KuaiZip_2{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_80_0 = {4b 75 61 69 5a 69 70 } //KuaiZip 1
$a_00_1 = {4b 75 61 69 5a 69 70 2e 4d 61 69 6e 57 6e 64 2e 54 6f 6f 6c 62 61 72 } //1 KuaiZip.MainWnd.Toolbar
$a_80_2 = {57 61 69 74 4f 74 68 65 72 4b 5a 69 70 } //WaitOtherKZip 1
$a_80_3 = {4b 5a 69 70 53 68 65 6c 6c 2e 64 6c 6c } //KZipShell.dll 1
condition:
((#a_80_0 & 1)*1+(#a_00_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=3
}
rule _#PUA_Block_KuaiZip_3{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 "
strings :
$a_80_0 = {6b 70 7a 69 70 2e 63 6f 6d } //kpzip.com 2
$a_80_1 = {4b 75 61 69 5a 69 70 20 53 65 74 75 70 } //KuaiZip Setup 2
$a_80_2 = {53 4f 46 54 57 41 52 45 5c 53 69 63 65 6e 74 } //SOFTWARE\Sicent 1
$a_80_3 = {53 4f 46 54 57 41 52 45 5c 48 69 6e 74 73 6f 66 74 } //SOFTWARE\Hintsoft 1
$a_80_4 = {53 4f 46 54 57 41 52 45 5c 47 6f 79 6f 6f } //SOFTWARE\Goyoo 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_4{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {64 6f 77 6e 31 2e 37 36 35 34 2e 63 6f 6d } //down1.7654.com 1
$a_80_1 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d } //i.kpzip.com 1
$a_80_2 = {6b 75 61 69 79 61 6d 69 6e 69 } //kuaiyamini 1
$a_80_3 = {77 77 77 2e 38 38 79 73 67 2e 63 6f 6d 2f 74 65 6d 70 6c 65 74 73 2f 38 38 79 73 67 2f 63 65 73 68 69 33 2e 68 74 6d } //www.88ysg.com/templets/88ysg/ceshi3.htm 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_5{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {4b 75 61 69 5a 69 70 54 69 70 73 32 } //KuaiZipTips2 1
$a_80_1 = {74 6a 2e 6b 70 7a 69 70 2e 63 6f 6d } //tj.kpzip.com 1
$a_80_2 = {68 61 6f 31 32 33 4a 75 7a 69 2e 65 78 65 } //hao123Juzi.exe 1
$a_80_3 = {61 70 69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 73 68 6f 77 63 6f 75 6e 74 2e 70 68 70 3f 6e 61 6d 65 3d } //api.kpzip.com/showcount.php?name= 1
$a_80_4 = {68 65 69 6e 6f 74 65 } //heinote 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_6{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {2f 2f 72 65 70 6f 72 74 2e 75 63 68 69 68 61 2e 6c 74 64 } ////report.uchiha.ltd 1
$a_80_1 = {64 6f 77 6e 34 2e 37 36 35 34 2e 63 6f 6d } //down4.7654.com 1
$a_80_2 = {64 2e 68 65 69 6e 6f 74 65 2e 63 6f 6d } //d.heinote.com 1
$a_80_3 = {52 65 70 6f 72 74 2e 65 78 65 } //Report.exe 1
$a_80_4 = {73 6f 66 74 77 61 72 65 5c 48 65 69 6e 6f 74 65 5c 72 65 70 6f 72 74 } //software\Heinote\report 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_7{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {6b 75 61 69 79 61 74 69 74 6c 65 } //kuaiyatitle 1
$a_80_1 = {7a 73 72 63 6b 63 67 2e 78 79 7a } //zsrckcg.xyz 1
$a_80_2 = {68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d } //hotnews.dftoutiao.com 1
$a_80_3 = {70 6f 70 6e 61 6d 65 3d 6d 69 6e 69 6e 65 77 73 } //popname=mininews 1
$a_80_4 = {4d 69 6e 69 44 65 62 75 67 65 72 } //MiniDebuger 1
$a_80_5 = {61 64 31 2e 37 36 35 34 2e 63 6f 6d } //ad1.7654.com 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_KuaiZip_8{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {6b 75 61 69 7a 69 70 72 65 70 6f 72 74 2f 6d 69 6e 69 6e 65 77 73 } //kuaizipreport/mininews 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 78 69 61 6f 79 75 5c 52 65 70 6f 72 74 5c 6f 66 66 6c 69 6e 65 } //Software\xiaoyu\Report\offline 1
$a_80_2 = {4b 5a 52 65 70 6f 72 74 2e 65 78 65 } //KZReport.exe 1
$a_80_3 = {53 65 74 50 6f 70 75 70 50 65 72 69 6f 64 } //SetPopupPeriod 1
$a_80_4 = {4d 69 6e 69 6e 65 77 73 54 69 74 6c 65 41 64 73 57 6e 64 } //MininewsTitleAdsWnd 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_9{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {74 69 70 73 2e 6e 61 6e 6a 69 6e 67 63 68 65 6e 78 69 2e 63 6f 6d } //tips.nanjingchenxi.com 1
$a_80_1 = {6b 75 61 69 7a 69 70 } //kuaizip 1
$a_80_2 = {32 33 34 35 63 68 72 6f 6d 65 2e 65 78 65 } //2345chrome.exe 1
$a_80_3 = {33 36 30 53 45 2e 65 78 65 } //360SE.exe 1
$a_80_4 = {6f 70 65 72 61 2e 65 78 65 } //opera.exe 1
$a_80_5 = {32 33 34 35 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //2345explorer.exe 1
$a_80_6 = {71 71 62 72 6f 77 73 65 72 2e 65 78 65 } //qqbrowser.exe 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_10{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {4b 75 61 69 7a 69 70 } //Kuaizip 1
$a_80_1 = {2f 2f 69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 72 65 70 6f 72 74 2f 72 65 70 6f 72 74 2e 74 78 74 } ////i.kpzip.com/n/report/report.txt 1
$a_80_2 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 49 6e 73 74 61 6c 6c } //Software\KuaiZip\Install 1
$a_80_3 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 52 65 70 6f 72 74 5c 49 6e 73 74 61 6c 6c } //Software\KuaiZip\Report\Install 1
$a_80_4 = {4b 5a 52 65 70 6f 72 74 2e 65 78 65 } //KZReport.exe 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_11{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {64 3a 5c 73 76 6e 72 6f 6f 74 5c 6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 4b 7a 55 70 64 61 74 65 41 67 65 6e 63 79 2e 70 64 62 } //d:\svnroot\kuaizip\trunk\bin\Release\X86\KzUpdateAgency.pdb 1
$a_80_1 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 74 75 69 2f 75 70 64 61 74 65 5f 61 67 65 6e 63 79 2f 6b 62 2e 78 6d 6c } //i.kpzip.com/n/tui/update_agency/kb.xml 1
$a_80_2 = {6b 7a 75 70 64 61 74 65 5f 61 67 65 6e 63 79 } //kzupdate_agency 1
$a_80_3 = {4b 75 61 69 5a 69 70 } //KuaiZip 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_12{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_80_0 = {53 6f 66 74 77 61 72 65 5c 37 36 35 34 42 72 6f 77 73 65 72 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 } //Software\7654Browser\UpdateChecker 1
$a_80_1 = {6c 6c 71 30 30 31 5c 73 72 63 5c 6f 75 74 5c 4f 66 66 69 63 69 61 6c 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 2e 65 78 65 2e 70 64 62 } //llq001\src\out\Official\UpdateChecker.exe.pdb 1
$a_80_2 = {65 72 72 2e 6c 6f 67 } //err.log 1
$a_80_3 = {7a 6d 5f 74 6f 6f 6c 73 5c 6d 75 6c 74 69 5f 65 78 65 5c 75 70 64 61 74 65 5f 63 68 65 63 6b 65 72 2e 63 63 } //zm_tools\multi_exe\update_checker.cc 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=3
}
rule _#PUA_Block_KuaiZip_13{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {53 6f 66 74 77 61 72 65 5c 6c 73 7a 69 70 5c 73 75 62 6d 69 74 5c 74 75 72 6e 6f 66 66 } //Software\lszip\submit\turnoff 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 78 69 6e 6e 6f 74 65 5c 72 65 70 6f 72 74 5c 6f 66 66 6c 69 6e 65 } //Software\xinnote\report\offline 1
$a_80_2 = {4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 } //MiniDumpWriteDump 1
$a_80_3 = {54 61 73 6b 62 61 72 43 72 65 61 74 65 64 } //TaskbarCreated 1
$a_80_4 = {53 6f 66 74 77 61 72 65 5c 51 69 6e 67 4a 69 65 50 64 66 5c 52 65 70 6f 72 74 } //Software\QingJiePdf\Report 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_14{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {2f 2f 64 6f 77 6e 31 2e 77 61 6c 6c 70 61 70 65 72 2e 73 68 71 69 6e 67 7a 61 6f 2e 63 6f 6d 2f 72 65 70 6f 72 74 2f 71 75 65 72 79 69 6e 66 6f 2e 78 6d 6c } ////down1.wallpaper.shqingzao.com/report/queryinfo.xml 1
$a_80_1 = {6d 69 6e 6b 65 72 6e 65 6c 5c 63 72 74 73 5c 75 63 72 74 5c 69 6e 63 5c 63 6f 72 65 63 72 74 5f 69 6e 74 65 72 6e 61 6c 5f 73 74 72 74 6f 78 2e 68 } //minkernel\crts\ucrt\inc\corecrt_internal_strtox.h 1
$a_80_2 = {52 65 70 6f 72 74 2e 65 78 65 } //Report.exe 1
$a_80_3 = {53 6f 66 74 77 61 72 65 5c 43 61 6c 66 57 61 6c 6c 70 61 70 65 72 5c 49 6e 73 74 61 6c 6c } //Software\CalfWallpaper\Install 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_15{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d } //i.kpzip.com 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 49 6e 73 74 61 6c 6c } //Software\KuaiZip\Install 1
$a_80_2 = {63 68 72 6f 6d 65 2e 65 78 65 } //chrome.exe 1
$a_80_3 = {6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 2e 70 64 62 } //kuaizip\trunk\bin\Release\X86\UpdateChecker.pdb 1
$a_80_4 = {6f 70 65 72 61 2e 65 78 65 } //opera.exe 1
$a_80_5 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 } //Software\KuaiZip\UpdateChecker 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_KuaiZip_16{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {6d 69 6e 69 6e 65 77 73 2d 68 6e 2e 37 36 35 34 2e 63 6f 6d 2f 6e 2f 74 75 69 2f 77 6b 65 2e 64 6c 6c } //mininews-hn.7654.com/n/tui/wke.dll 1
$a_80_1 = {74 6a 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6b 75 61 69 7a 69 70 72 65 70 6f 72 74 } //tj.kpzip.com/kuaizipreport 1
$a_80_2 = {65 3a 5c 5a 4d 5f 50 72 6f 6a 65 63 74 5c 4b 75 61 69 5a 69 70 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 6d 69 6e 69 6e 65 77 73 2e 70 64 62 } //e:\ZM_Project\KuaiZip\bin\Release\X86\mininews.pdb 1
$a_80_3 = {77 77 77 2e 6b 75 61 69 7a 69 70 2e 63 6f 6d 2f 6d 65 6d 62 65 72 2f 69 6e 64 65 78 2e 70 68 70 } //www.kuaizip.com/member/index.php 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_17{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {64 3a 5c 73 76 6e 72 6f 6f 74 5c 6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 2e 70 64 62 } //d:\svnroot\kuaizip\trunk\bin\Release\X86\UpdateChecker.pdb 2
$a_80_1 = {6c 69 65 62 61 6f 2e 65 78 65 } //liebao.exe 1
$a_80_2 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 75 70 64 61 74 65 63 68 65 63 6b 65 72 2f 6b 62 2e 78 6d 6c } //i.kpzip.com/n/updatechecker/kb.xml 1
$a_80_3 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 49 6e 73 74 61 6c 6c } //Software\KuaiZip\Install 1
$a_80_4 = {6b 75 61 69 7a 69 70 72 65 70 6f 72 74 } //kuaizipreport 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_18{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 00 "
strings :
$a_80_0 = {6b 75 61 69 79 61 } //kuaiya 1
$a_80_1 = {6b 75 61 69 7a 69 70 } //kuaizip 1
$a_80_2 = {57 68 69 72 6c 77 69 6e 64 50 64 66 } //WhirlwindPdf 1
$a_00_3 = {32 33 34 35 63 68 72 6f 6d 65 } //1 2345chrome
$a_00_4 = {74 69 70 73 2e 6e 61 6e 6a 69 6e 67 63 68 65 6e 78 69 2e 63 6f 6d } //1 tips.nanjingchenxi.com
$a_00_5 = {6e 65 77 73 2e 74 6f 75 74 69 61 6f 62 61 73 68 69 2e 63 6f 6d } //1 news.toutiaobashi.com
$a_00_6 = {33 36 30 63 68 72 6f 6d 65 2e 65 78 65 } //1 360chrome.exe
$a_00_7 = {6f 70 65 72 61 2e 65 78 65 } //1 opera.exe
$a_80_8 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_9 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_80_8 & 1)*-100+(#a_80_9 & 1)*-100) >=8
}
rule _#PUA_Block_KuaiZip_19{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {74 70 6f 70 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 74 75 69 2f 74 70 6f 70 2f 74 70 6f 70 34 2f 6b 62 5f 6e 6f 70 6f 70 2e 78 6d 6c } //tpop.kpzip.com/n/tui/tpop/tpop4/kb_nopop.xml 1
$a_80_1 = {64 6f 77 6e 32 2e 37 36 35 34 2e 63 6f 6d } //down2.7654.com 1
$a_80_2 = {65 3a 5c 5a 4d 5f 50 72 6f 6a 65 63 74 5c 4b 75 61 69 5a 69 70 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 74 70 6f 70 34 2e 70 64 62 } //e:\ZM_Project\KuaiZip\bin\Release\X86\tpop4.pdb 1
$a_80_3 = {68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d } //hotnews.dftoutiao.com 1
$a_80_4 = {2f 6b 75 61 69 7a 69 70 72 65 70 6f 72 74 2f 6d 69 6e 69 6e 65 77 73 } ///kuaizipreport/mininews 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_20{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 00 "
strings :
$a_80_0 = {6b 75 61 69 79 61 74 69 74 6c 65 } //kuaiyatitle 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 78 69 6e 6e 6f 74 65 5c 49 6e 73 74 61 6c 6c } //Software\xinnote\Install 1
$a_80_2 = {68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d } //hotnews.dftoutiao.com 1
$a_80_3 = {6e 65 77 73 2e 37 36 35 34 2e 63 6f 6d } //news.7654.com 1
$a_80_4 = {4d 69 6e 69 44 65 62 75 67 65 72 } //MiniDebuger 1
$a_02_5 = {72 00 65 00 70 00 6f 00 72 00 74 00 2e 00 [0-0f] 2e 00 6d 00 75 00 78 00 69 00 6e 00 2e 00 66 00 75 00 6e 00 } //1
$a_02_6 = {72 65 70 6f 72 74 2e [0-0f] 2e 6d 75 78 69 6e 2e 66 75 6e } //1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1) >=6
}
rule _#PUA_Block_KuaiZip_21{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_80_0 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d } //i.kpzip.com 1
$a_80_1 = {5c 4b 75 61 69 5a 69 70 5c 4b 75 61 69 5a 69 70 5f 53 65 74 75 70 2e 65 78 65 } //\KuaiZip\KuaiZip_Setup.exe 1
$a_80_2 = {61 70 69 2e 6b 70 7a 69 70 2e 63 6f 6d } //api.kpzip.com 1
$a_80_3 = {64 3a 5c 73 76 6e 72 6f 6f 74 5c 6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 4b 7a 55 70 64 61 74 65 41 67 65 6e 63 79 2e 70 64 62 } //d:\svnroot\kuaizip\trunk\bin\Release\X86\KzUpdateAgency.pdb 1
$a_80_4 = {6b 7a 75 70 64 61 74 65 61 67 65 6e 63 79 } //kzupdateagency 1
$a_80_5 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_6 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=5
}
rule _#PUA_Block_KuaiZip_22{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {75 73 65 5f 72 75 6e 5f 73 63 72 65 65 6e 73 61 76 65 72 5f 68 6f 74 6b 65 79 } //use_run_screensaver_hotkey 1
$a_00_1 = {53 4f 46 54 57 41 52 45 5c 53 69 63 65 6e 74 } //1 SOFTWARE\Sicent
$a_80_2 = {61 64 5f 62 72 6f 77 73 65 72 5f 65 76 65 6e 74 5f 68 61 6e 64 6c 65 72 } //ad_browser_event_handler 1
$a_00_3 = {53 4f 46 54 57 41 52 45 5c 47 6f 79 6f 6f } //1 SOFTWARE\Goyoo
$a_00_4 = {53 4f 46 54 57 41 52 45 5c 48 69 6e 74 73 6f 66 74 } //1 SOFTWARE\Hintsoft
$a_00_5 = {52 65 6c 65 61 73 65 5f 7a 68 61 6e 5f 6d 65 6e 67 5c 57 69 6e 33 32 5c 73 63 72 65 65 6e 5f 73 61 76 65 72 2e 65 78 65 2e 70 64 62 } //1 Release_zhan_meng\Win32\screen_saver.exe.pdb
$a_80_6 = {53 6f 66 74 77 61 72 65 5c 53 63 72 65 65 6e 53 61 76 65 72 } //Software\ScreenSaver 1
condition:
((#a_80_0 & 1)*1+(#a_00_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_23{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 55 6e 69 6e 73 74 61 6c 6c 5c 4b 75 61 69 5a 69 70 } //SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KuaiZip 1
$a_80_1 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c 43 69 74 79 43 68 65 63 6b } //Software\KuaiZip\CityCheck 1
$a_80_2 = {48 65 69 6e 6f 74 65 2e 69 6e 69 } //Heinote.ini 1
$a_80_3 = {2f 2f 61 70 69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 73 68 6f 77 63 6f 75 6e 74 2e 70 68 70 3f 6e 61 6d 65 3d } ////api.kpzip.com/showcount.php?name= 1
$a_80_4 = {2f 2f 6b 79 70 6f 73 69 74 69 6f 6e 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d 2f 70 6f 73 69 74 69 6f 6e 2f 67 65 74 30 32 } ////kyposition.dftoutiao.com/position/get02 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_24{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 00 "
strings :
$a_00_0 = {61 00 62 00 63 00 6b 00 61 00 6e 00 74 00 75 00 2e 00 63 00 6f 00 6d 00 } //2 abckantu.com
$a_00_1 = {72 65 70 6f 72 74 2e 73 63 72 65 65 6e 73 61 76 65 72 73 2e 73 68 7a 68 61 6e 6d 65 6e 67 2e 63 6f 6d } //2 report.screensavers.shzhanmeng.com
$a_00_2 = {64 00 6f 00 77 00 6e 00 32 00 32 00 2e 00 7a 00 6d 00 6d 00 64 00 6e 00 2e 00 63 00 6f 00 6d 00 } //2 down22.zmmdn.com
$a_00_3 = {64 6f 77 6e 2e 78 69 61 6c 64 2e 63 6f 6d } //1 down.xiald.com
$a_80_4 = {53 4f 46 54 57 41 52 45 5c 48 69 6e 74 73 6f 66 74 } //SOFTWARE\Hintsoft 1
$a_80_5 = {53 4f 46 54 57 41 52 45 5c 53 69 63 65 6e 74 } //SOFTWARE\Sicent 1
$a_80_6 = {53 4f 46 54 57 41 52 45 5c 47 6f 79 6f 6f } //SOFTWARE\Goyoo 1
$a_00_7 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 50 00 68 00 6f 00 74 00 6f 00 56 00 69 00 65 00 77 00 65 00 72 00 } //2 Software\PhotoViewer
$a_80_8 = {53 6f 66 74 77 61 72 65 5c 53 63 72 65 65 6e 53 61 76 65 72 } //Software\ScreenSaver 2
condition:
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_00_7 & 1)*2+(#a_80_8 & 1)*2) >=4
}
rule _#PUA_Block_KuaiZip_25{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 00 "
strings :
$a_80_0 = {73 74 61 74 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 73 74 61 74 2f 69 6e 64 65 78 2e 70 68 70 } //stat.kpzip.com/stat/index.php 2
$a_80_1 = {69 2e 6b 70 7a 69 70 2e 63 6f 6d 2f 6e 2f 75 70 64 61 74 65 2f 6b 62 2e 78 6d 6c } //i.kpzip.com/n/update/kb.xml 1
$a_80_2 = {6b 7a 55 70 64 61 74 65 2e 43 50 72 6f 6d 70 74 55 70 67 72 61 64 65 2e 53 43 5f 43 4c 4f 53 45 } //kzUpdate.CPromptUpgrade.SC_CLOSE 1
$a_80_3 = {64 3a 5c 73 76 6e 72 6f 6f 74 5c 6b 75 61 69 7a 69 70 5c 74 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 58 38 36 5c 55 70 64 61 74 65 2e 70 64 62 } //d:\svnroot\kuaizip\trunk\bin\Release\X86\Update.pdb 1
$a_80_4 = {50 65 72 72 79 53 68 61 64 6f 77 57 6e 64 } //PerryShadowWnd 1
$a_80_5 = {4b 7a 55 70 64 61 74 65 2e 65 78 65 } //KzUpdate.exe 1
$a_80_6 = {4b 75 61 69 7a 69 70 53 65 74 75 70 5f } //KuaizipSetup_ 1
$a_80_7 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_8 = {55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 } //Uninstaller.exe -100
$a_80_9 = {55 6e 69 6e 73 74 61 6c 2e 65 78 65 } //Uninstal.exe -100
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100+(#a_80_9 & 1)*-100) >=6
}
rule _#PUA_Block_KuaiZip_26{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 "
strings :
$a_80_0 = {53 6f 66 74 77 61 72 65 5c 43 61 6c 66 57 61 6c 6c 70 61 70 65 72 5c 69 6e 73 74 61 6c 6c } //Software\CalfWallpaper\install 1
$a_02_1 = {43 00 3a 00 5c 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 73 00 20 00 61 00 6e 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 5c 00 [0-0f] 5c 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 44 00 61 00 74 00 61 00 5c 00 43 00 61 00 6c 00 66 00 57 00 61 00 6c 00 6c 00 70 00 61 00 70 00 65 00 72 00 5c 00 } //1
$a_02_2 = {43 3a 5c 44 6f 63 75 6d 65 6e 74 73 20 61 6e 64 20 53 65 74 74 69 6e 67 73 5c [0-0f] 5c 41 70 70 6c 69 63 61 74 69 6f 6e 20 44 61 74 61 5c 43 61 6c 66 57 61 6c 6c 70 61 70 65 72 5c } //1
$a_80_3 = {43 61 6c 66 57 61 6c 6c 70 61 70 65 72 2e 65 78 65 } //CalfWallpaper.exe 1
$a_80_4 = {67 75 61 6e 77 61 6e 67 5f 30 30 31 } //guanwang_001 1
$a_80_5 = {68 74 74 70 3a 2f 2f 72 65 70 6f 72 74 2e 77 61 6c 6c 70 61 70 65 72 2e 73 68 71 69 6e 67 7a 61 6f 2e 63 6f 6d } //http://report.wallpaper.shqingzao.com 1
condition:
((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=4
}
rule _#PUA_Block_KuaiZip_27{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 00 "
strings :
$a_01_0 = {53 6f 66 74 77 61 72 65 5c 37 36 35 34 42 72 6f 77 73 65 72 5c } //1 Software\7654Browser\
$a_01_1 = {53 6f 66 74 77 61 72 65 5c 4b 75 61 69 5a 69 70 5c } //1 Software\KuaiZip\
$a_01_2 = {53 75 5a 69 70 } //1 SuZip
$a_01_3 = {58 75 6e 5a 69 70 } //1 XunZip
$a_01_4 = {6b 70 7a 69 70 2e 63 6f 6d } //1 kpzip.com
$a_01_5 = {37 36 35 34 2e 63 6f 6d 2f 6e 2f 74 75 69 } //1 7654.com/n/tui
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_28{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {74 6a 2e 67 6c 7a 69 70 2e 63 6f 6d } //1 tj.glzip.com
$a_01_1 = {74 6a 31 2e 37 36 35 34 2e 63 6f 6d } //1 tj1.7654.com
$a_01_2 = {78 79 6e 6f 74 65 2e 73 68 7a 68 61 6e 6d 65 6e 67 2e 63 6f 6d } //1 xynote.shzhanmeng.com
$a_01_3 = {6d 69 6e 69 5f 6e 65 77 73 5f 73 6b 69 6e 5f 61 64 2e 64 6c 6c } //1 mini_news_skin_ad.dll
$a_01_4 = {6b 75 61 69 7a 69 70 72 65 70 6f 72 74 } //1 kuaizipreport
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
rule _#PUA_Block_KuaiZip_29{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,03 00 03 00 02 00 00 "
strings :
$a_01_0 = {62 72 61 6e 63 68 65 73 5c 78 69 61 6f 79 75 54 72 75 6e 6b 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 57 69 6e 33 32 5c 55 70 67 72 61 64 65 2e 70 64 62 } //2 branches\xiaoyuTrunk\bin\Release\Win32\Upgrade.pdb
$a_01_1 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 78 00 69 00 61 00 6f 00 79 00 75 00 5c 00 55 00 70 00 64 00 61 00 74 00 65 00 43 00 68 00 65 00 63 00 6b 00 65 00 72 00 } //1 Software\xiaoyu\UpdateChecker
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3
}
rule _#PUA_Block_KuaiZip_30{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,07 00 07 00 06 00 00 "
strings :
$a_01_0 = {68 74 74 70 3a 2f 2f 6e 65 77 73 2e 37 36 35 34 2e 63 6f 6d 2f } //2 http://news.7654.com/
$a_01_1 = {7b 38 38 46 36 30 30 41 43 2d 45 36 41 38 2d 34 41 45 31 2d 41 43 46 37 2d 37 33 44 35 43 41 41 44 30 39 34 33 7d } //2 {88F600AC-E6A8-4AE1-ACF7-73D5CAAD0943}
$a_01_2 = {2f 73 6d 61 72 74 6c 6f 6f 6b 2f 70 6f 70 75 70 3f 63 6f 64 65 3d } //2 /smartlook/popup?code=
$a_01_3 = {48 4b 45 59 5f 43 55 52 52 45 4e 54 5f 55 53 45 52 5c 53 6f 66 74 77 61 72 65 5c } //1 HKEY_CURRENT_USER\Software\
$a_01_4 = {37 36 35 34 42 72 6f 77 73 65 72 } //1 7654Browser
$a_01_5 = {4d 69 6e 69 4e 65 77 73 49 6e 66 6f } //1 MiniNewsInfo
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7
}
rule _#PUA_Block_KuaiZip_31{
meta:
description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 53 00 69 00 63 00 65 00 6e 00 74 00 00 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 47 00 6f 00 79 00 6f 00 6f 00 00 00 00 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 48 00 69 00 6e 00 74 00 73 00 6f 00 66 00 74 00 } //3
$a_01_1 = {53 4f 46 54 57 41 52 45 5c 48 65 69 6e 6f 74 65 } //1 SOFTWARE\Heinote
$a_01_2 = {53 6f 66 74 77 61 72 65 5c 78 69 61 6f 79 75 } //1 Software\xiaoyu
$a_01_3 = {68 65 69 6e 6f 74 65 2e 37 36 35 34 2e 63 6f 6d 2f 78 69 65 79 69 2e 68 74 6d 6c } //1 heinote.7654.com/xieyi.html
$a_01_4 = {78 69 61 6f 79 75 2e 73 68 7a 68 61 6e 6d 65 6e 67 2e 63 6f 6d 2f 6c 6f 67 6f } //1 xiaoyu.shzhanmeng.com/logo
condition:
((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
#PUA/Block/_#PUA_Block_OfferCore.yar
+179 -179
View File
@@ -1,180 +1,180 @@
rule _#PUA_Block_OfferCore{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_80_0 = {63 6f 6e 74 72 6f 6c 2e 6b 6f 63 68 61 76 61 2e 63 6f 6d } //control.kochava.com 1
$a_80_1 = {49 6e 73 74 61 6c 6c 6f 66 66 65 72 73 } //Installoffers 2
$a_80_2 = {69 6e 6e 6f 73 65 74 75 70 } //innosetup 1
$a_80_3 = {4c 69 6e 6b 76 65 72 74 69 73 65 20 47 6d 62 48 20 26 20 43 6f 2e 20 4b 47 } //Linkvertise GmbH & Co. KG 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_OfferCore_2{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {2f 2f 72 69 73 65 63 6f 64 65 73 2e 63 6f 6d 2f 70 72 69 76 61 63 79 } ////risecodes.com/privacy 1
$a_80_1 = {54 44 4f 57 4e 4c 4f 41 44 57 49 5a 41 52 44 50 41 47 45 } //TDOWNLOADWIZARDPAGE 1
$a_80_2 = {48 49 44 45 44 4f 57 4e 4c 4f 41 44 50 41 47 45 } //HIDEDOWNLOADPAGE 1
$a_80_3 = {4f 50 45 4e 4d 41 49 4e 43 41 52 52 49 45 52 49 4e 57 45 42 42 52 4f 57 53 45 52 } //OPENMAINCARRIERINWEBBROWSER 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_OfferCore_3{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 00 "
strings :
$a_80_0 = {64 32 75 34 64 30 38 30 63 6b 68 70 6c 68 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 } //d2u4d080ckhplh.cloudfront.net 5
$a_80_1 = {43 48 45 43 4b 4f 46 46 45 52 } //CHECKOFFER 1
$a_80_2 = {49 4e 53 54 41 4c 4c 4f 46 46 45 52 53 } //INSTALLOFFERS 1
$a_80_3 = {50 61 67 65 4f 66 66 65 72 41 63 74 69 76 61 74 65 } //PageOfferActivate 1
$a_80_4 = {47 65 74 53 65 61 72 63 68 45 6e 67 69 6e 65 73 } //GetSearchEngines 1
$a_80_5 = {63 68 65 61 74 65 6e 67 69 6e 65 } //cheatengine 5
condition:
((#a_80_0 & 1)*5+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*5) >=12
}
rule _#PUA_Block_OfferCore_4{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {2f 2f 72 69 73 65 63 6f 64 65 73 2e 63 6f 6d 2f 70 72 69 76 61 63 79 } ////risecodes.com/privacy 1
$a_80_1 = {64 31 72 31 71 6f 75 32 38 63 37 63 71 67 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 7a 62 64 } //d1r1qou28c7cqg.cloudfront.net/zbd 1
$a_80_2 = {47 45 54 49 4e 53 54 41 4c 4c 53 } //GETINSTALLS 1
$a_80_3 = {44 4f 57 4e 4c 4f 41 44 54 45 4d 50 4f 52 41 52 59 46 49 4c 45 } //DOWNLOADTEMPORARYFILE 1
$a_80_4 = {43 6f 6e 74 61 69 6e 73 4b 65 79 } //ContainsKey 1
$a_80_5 = {41 76 69 6e 73 74 61 6c 6c 65 72 } //Avinstaller 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_OfferCore_5{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //GETOFFERINDEXBYPAGE 1
$a_80_1 = {49 53 54 48 45 4c 41 53 54 4f 46 46 45 52 50 41 47 45 49 46 41 4e 59 } //ISTHELASTOFFERPAGEIFANY 1
$a_80_2 = {50 41 47 45 4f 46 46 45 52 41 43 54 49 56 41 54 45 } //PAGEOFFERACTIVATE 1
$a_80_3 = {50 41 47 45 4f 46 46 45 52 44 45 49 4e 49 54 49 41 4c 49 5a 45 } //PAGEOFFERDEINITIALIZE 1
$a_80_4 = {50 41 47 45 4f 46 46 45 52 43 52 45 41 54 45 } //PAGEOFFERCREATE 1
$a_80_5 = {49 4e 53 54 41 4c 4c 4f 46 46 45 52 53 } //INSTALLOFFERS 1
$a_80_6 = {43 48 45 43 4b 4f 46 46 45 52 } //CHECKOFFER 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_6{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {53 6f 66 74 6f 6e 69 63 5f 44 4c 4d } //Softonic_DLM 1
$a_80_1 = {47 45 54 41 44 53 45 52 56 45 52 52 45 53 50 4f 4e 53 45 } //GETADSERVERRESPONSE 1
$a_80_2 = {50 41 47 45 4f 46 46 45 52 43 52 45 41 54 45 } //PAGEOFFERCREATE 1
$a_80_3 = {50 41 47 45 4f 46 46 45 52 41 43 54 49 56 41 54 45 } //PAGEOFFERACTIVATE 1
$a_80_4 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //GETOFFERINDEXBYPAGE 1
$a_80_5 = {49 53 54 48 45 4c 41 53 54 4f 46 46 45 52 50 41 47 45 49 46 41 4e 59 } //ISTHELASTOFFERPAGEIFANY 1
$a_80_6 = {50 41 47 45 4f 46 46 45 52 44 45 49 4e 49 54 49 41 4c 49 5a 45 } //PAGEOFFERDEINITIALIZE 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_7{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {63 6f 6e 74 72 6f 6c 2e 6b 6f 63 68 61 76 61 2e 63 6f 6d 2f 76 31 2f 63 70 69 2f 63 6c 69 63 6b } //control.kochava.com/v1/cpi/click 1
$a_80_1 = {64 31 70 71 6e 36 6d 35 79 77 6e 77 33 61 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 } //d1pqn6m5ywnw3a.cloudfront.net 1
$a_80_2 = {47 45 54 4f 46 46 45 52 53 41 52 52 41 59 } //GETOFFERSARRAY 1
$a_80_3 = {50 61 67 65 4f 66 66 65 72 41 63 74 69 76 61 74 65 } //PageOfferActivate 1
$a_80_4 = {50 41 47 45 4f 46 46 45 52 43 52 45 41 54 45 } //PAGEOFFERCREATE 1
$a_80_5 = {59 61 6e 64 65 78 42 72 6f 77 73 65 72 } //YandexBrowser 1
$a_80_6 = {6b 6f 68 6f 74 73 70 6f 74 2d 73 68 69 65 6c 64 } //kohotspot-shield 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_8{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 "
strings :
$a_80_0 = {63 68 65 63 6b 5f 6f 66 66 65 72 5f 72 65 73 75 6c 74 } //check_offer_result 1
$a_80_1 = {65 6c 69 67 69 62 6c 65 5f 6f 66 66 65 72 } //eligible_offer 1
$a_80_2 = {6f 66 66 65 72 5f 73 65 74 } //offer_set 1
$a_80_3 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //GETOFFERINDEXBYPAGE 1
$a_80_4 = {50 41 47 45 4f 46 46 45 52 41 43 54 49 56 41 54 45 } //PAGEOFFERACTIVATE 1
$a_80_5 = {43 52 45 41 54 45 4f 46 46 45 52 53 } //CREATEOFFERS 1
$a_80_6 = {43 48 45 43 4b 4f 46 46 45 52 } //CHECKOFFER 1
$a_80_7 = {50 52 4f 43 45 53 53 4f 46 46 45 52 53 54 52 49 4e 47 53 } //PROCESSOFFERSTRINGS 1
$a_80_8 = {47 45 54 41 44 53 45 52 56 45 52 52 45 53 50 4f 4e 53 45 } //GETADSERVERRESPONSE 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_9{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 "
strings :
$a_80_0 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //GETOFFERINDEXBYPAGE 1
$a_80_1 = {47 45 54 4f 46 46 45 52 53 41 52 52 41 59 } //GETOFFERSARRAY 1
$a_80_2 = {50 41 47 45 4f 46 46 45 52 41 43 54 49 56 41 54 45 } //PAGEOFFERACTIVATE 1
$a_80_3 = {49 4e 53 54 41 4c 4c 4f 46 46 45 52 53 } //INSTALLOFFERS 1
$a_80_4 = {43 48 45 43 4b 4f 46 46 45 52 } //CHECKOFFER 1
$a_80_5 = {50 41 47 45 4f 46 46 45 52 42 41 43 4b 42 55 54 54 4f 4e 43 4c 49 43 4b } //PAGEOFFERBACKBUTTONCLICK 1
$a_80_6 = {50 41 47 45 4f 46 46 45 52 53 48 4f 55 4c 44 53 4b 49 50 50 41 47 45 } //PAGEOFFERSHOULDSKIPPAGE 1
$a_80_7 = {50 52 4f 43 45 53 53 4f 46 46 45 52 53 54 52 49 4e 47 53 } //PROCESSOFFERSTRINGS 1
$a_80_8 = {47 45 54 41 44 53 45 52 56 45 52 52 45 53 50 4f 4e 53 45 } //GETADSERVERRESPONSE 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_10{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 00 "
strings :
$a_00_0 = {47 45 54 4f 46 46 45 52 53 41 52 52 41 59 } //1 GETOFFERSARRAY
$a_00_1 = {47 45 54 49 4e 4a 45 43 54 45 44 50 41 52 41 4d } //1 GETINJECTEDPARAM
$a_00_2 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //1 GETOFFERINDEXBYPAGE
$a_00_3 = {50 41 47 45 4f 46 46 45 52 43 52 45 41 54 45 } //1 PAGEOFFERCREATE
$a_00_4 = {50 61 67 65 4f 66 66 65 72 41 63 74 69 76 61 74 65 } //1 PageOfferActivate
$a_80_5 = {63 61 6d 70 61 69 67 6e 5f 69 64 3d 6b 6f 68 6f 74 73 70 6f 74 2d 73 68 69 65 6c 64 } //campaign_id=kohotspot-shield 1
$a_80_6 = {4f 70 65 72 61 5c 6f 70 65 72 61 2e 65 78 65 } //Opera\opera.exe 1
$a_80_7 = {59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 } //Yandex\YandexBrowser 1
$a_80_8 = {63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f } //cloudfront.net/ 1
$a_80_9 = {49 6e 6e 6f 53 65 74 75 70 4c 64 72 57 69 6e 64 6f 77 } //InnoSetupLdrWindow 1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=9
}
rule _#PUA_Block_OfferCore_11{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 00 "
strings :
$a_80_0 = {53 45 54 42 55 4e 44 4c 45 4f 46 46 45 52 45 44 } //SETBUNDLEOFFERED 1
$a_80_1 = {44 4f 57 4e 4c 4f 41 44 42 55 4e 44 4c 45 } //DOWNLOADBUNDLE 1
$a_80_2 = {49 4e 53 54 41 4c 4c 42 55 4e 44 4c 45 } //INSTALLBUNDLE 1
$a_80_3 = {49 4e 53 54 41 4c 4c 41 43 43 45 50 54 45 44 42 55 4e 44 4c 45 53 } //INSTALLACCEPTEDBUNDLES 1
$a_80_4 = {4f 50 45 52 41 5f 4c 49 4e 4b 54 45 52 4d 53 43 4c 49 43 4b 45 44 } //OPERA_LINKTERMSCLICKED 1
$a_80_5 = {4f 50 45 52 41 5f 4c 49 4e 4b 50 4f 4c 49 43 59 43 4c 49 43 4b 45 44 } //OPERA_LINKPOLICYCLICKED 1
$a_80_6 = {43 52 45 41 54 45 4f 50 45 52 41 50 41 47 45 } //CREATEOPERAPAGE 1
$a_80_7 = {41 56 33 36 30 5f 4c 49 4e 4b 54 45 52 4d 53 43 4c 49 43 4b 45 44 } //AV360_LINKTERMSCLICKED 1
$a_80_8 = {41 56 33 36 30 5f 4c 49 4e 4b 50 4f 4c 49 43 59 43 4c 49 43 4b 45 44 } //AV360_LINKPOLICYCLICKED 1
$a_80_9 = {43 52 45 41 54 45 41 56 33 36 30 50 41 47 45 } //CREATEAV360PAGE 1
$a_80_10 = {6d 65 6e 74 61 6c 6d 65 6e 74 6f 72 2e 65 78 65 } //mentalmentor.exe 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1) >=11
rule _#PUA_Block_OfferCore{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_80_0 = {63 6f 6e 74 72 6f 6c 2e 6b 6f 63 68 61 76 61 2e 63 6f 6d } //control.kochava.com 1
$a_80_1 = {49 6e 73 74 61 6c 6c 6f 66 66 65 72 73 } //Installoffers 2
$a_80_2 = {69 6e 6e 6f 73 65 74 75 70 } //innosetup 1
$a_80_3 = {4c 69 6e 6b 76 65 72 74 69 73 65 20 47 6d 62 48 20 26 20 43 6f 2e 20 4b 47 } //Linkvertise GmbH & Co. KG 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_OfferCore_2{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {2f 2f 72 69 73 65 63 6f 64 65 73 2e 63 6f 6d 2f 70 72 69 76 61 63 79 } ////risecodes.com/privacy 1
$a_80_1 = {54 44 4f 57 4e 4c 4f 41 44 57 49 5a 41 52 44 50 41 47 45 } //TDOWNLOADWIZARDPAGE 1
$a_80_2 = {48 49 44 45 44 4f 57 4e 4c 4f 41 44 50 41 47 45 } //HIDEDOWNLOADPAGE 1
$a_80_3 = {4f 50 45 4e 4d 41 49 4e 43 41 52 52 49 45 52 49 4e 57 45 42 42 52 4f 57 53 45 52 } //OPENMAINCARRIERINWEBBROWSER 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_OfferCore_3{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 00 "
strings :
$a_80_0 = {64 32 75 34 64 30 38 30 63 6b 68 70 6c 68 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 } //d2u4d080ckhplh.cloudfront.net 5
$a_80_1 = {43 48 45 43 4b 4f 46 46 45 52 } //CHECKOFFER 1
$a_80_2 = {49 4e 53 54 41 4c 4c 4f 46 46 45 52 53 } //INSTALLOFFERS 1
$a_80_3 = {50 61 67 65 4f 66 66 65 72 41 63 74 69 76 61 74 65 } //PageOfferActivate 1
$a_80_4 = {47 65 74 53 65 61 72 63 68 45 6e 67 69 6e 65 73 } //GetSearchEngines 1
$a_80_5 = {63 68 65 61 74 65 6e 67 69 6e 65 } //cheatengine 5
condition:
((#a_80_0 & 1)*5+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*5) >=12
}
rule _#PUA_Block_OfferCore_4{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {2f 2f 72 69 73 65 63 6f 64 65 73 2e 63 6f 6d 2f 70 72 69 76 61 63 79 } ////risecodes.com/privacy 1
$a_80_1 = {64 31 72 31 71 6f 75 32 38 63 37 63 71 67 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 7a 62 64 } //d1r1qou28c7cqg.cloudfront.net/zbd 1
$a_80_2 = {47 45 54 49 4e 53 54 41 4c 4c 53 } //GETINSTALLS 1
$a_80_3 = {44 4f 57 4e 4c 4f 41 44 54 45 4d 50 4f 52 41 52 59 46 49 4c 45 } //DOWNLOADTEMPORARYFILE 1
$a_80_4 = {43 6f 6e 74 61 69 6e 73 4b 65 79 } //ContainsKey 1
$a_80_5 = {41 76 69 6e 73 74 61 6c 6c 65 72 } //Avinstaller 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_OfferCore_5{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //GETOFFERINDEXBYPAGE 1
$a_80_1 = {49 53 54 48 45 4c 41 53 54 4f 46 46 45 52 50 41 47 45 49 46 41 4e 59 } //ISTHELASTOFFERPAGEIFANY 1
$a_80_2 = {50 41 47 45 4f 46 46 45 52 41 43 54 49 56 41 54 45 } //PAGEOFFERACTIVATE 1
$a_80_3 = {50 41 47 45 4f 46 46 45 52 44 45 49 4e 49 54 49 41 4c 49 5a 45 } //PAGEOFFERDEINITIALIZE 1
$a_80_4 = {50 41 47 45 4f 46 46 45 52 43 52 45 41 54 45 } //PAGEOFFERCREATE 1
$a_80_5 = {49 4e 53 54 41 4c 4c 4f 46 46 45 52 53 } //INSTALLOFFERS 1
$a_80_6 = {43 48 45 43 4b 4f 46 46 45 52 } //CHECKOFFER 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_6{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {53 6f 66 74 6f 6e 69 63 5f 44 4c 4d } //Softonic_DLM 1
$a_80_1 = {47 45 54 41 44 53 45 52 56 45 52 52 45 53 50 4f 4e 53 45 } //GETADSERVERRESPONSE 1
$a_80_2 = {50 41 47 45 4f 46 46 45 52 43 52 45 41 54 45 } //PAGEOFFERCREATE 1
$a_80_3 = {50 41 47 45 4f 46 46 45 52 41 43 54 49 56 41 54 45 } //PAGEOFFERACTIVATE 1
$a_80_4 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //GETOFFERINDEXBYPAGE 1
$a_80_5 = {49 53 54 48 45 4c 41 53 54 4f 46 46 45 52 50 41 47 45 49 46 41 4e 59 } //ISTHELASTOFFERPAGEIFANY 1
$a_80_6 = {50 41 47 45 4f 46 46 45 52 44 45 49 4e 49 54 49 41 4c 49 5a 45 } //PAGEOFFERDEINITIALIZE 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_7{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {63 6f 6e 74 72 6f 6c 2e 6b 6f 63 68 61 76 61 2e 63 6f 6d 2f 76 31 2f 63 70 69 2f 63 6c 69 63 6b } //control.kochava.com/v1/cpi/click 1
$a_80_1 = {64 31 70 71 6e 36 6d 35 79 77 6e 77 33 61 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 } //d1pqn6m5ywnw3a.cloudfront.net 1
$a_80_2 = {47 45 54 4f 46 46 45 52 53 41 52 52 41 59 } //GETOFFERSARRAY 1
$a_80_3 = {50 61 67 65 4f 66 66 65 72 41 63 74 69 76 61 74 65 } //PageOfferActivate 1
$a_80_4 = {50 41 47 45 4f 46 46 45 52 43 52 45 41 54 45 } //PAGEOFFERCREATE 1
$a_80_5 = {59 61 6e 64 65 78 42 72 6f 77 73 65 72 } //YandexBrowser 1
$a_80_6 = {6b 6f 68 6f 74 73 70 6f 74 2d 73 68 69 65 6c 64 } //kohotspot-shield 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_8{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 "
strings :
$a_80_0 = {63 68 65 63 6b 5f 6f 66 66 65 72 5f 72 65 73 75 6c 74 } //check_offer_result 1
$a_80_1 = {65 6c 69 67 69 62 6c 65 5f 6f 66 66 65 72 } //eligible_offer 1
$a_80_2 = {6f 66 66 65 72 5f 73 65 74 } //offer_set 1
$a_80_3 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //GETOFFERINDEXBYPAGE 1
$a_80_4 = {50 41 47 45 4f 46 46 45 52 41 43 54 49 56 41 54 45 } //PAGEOFFERACTIVATE 1
$a_80_5 = {43 52 45 41 54 45 4f 46 46 45 52 53 } //CREATEOFFERS 1
$a_80_6 = {43 48 45 43 4b 4f 46 46 45 52 } //CHECKOFFER 1
$a_80_7 = {50 52 4f 43 45 53 53 4f 46 46 45 52 53 54 52 49 4e 47 53 } //PROCESSOFFERSTRINGS 1
$a_80_8 = {47 45 54 41 44 53 45 52 56 45 52 52 45 53 50 4f 4e 53 45 } //GETADSERVERRESPONSE 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_9{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 "
strings :
$a_80_0 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //GETOFFERINDEXBYPAGE 1
$a_80_1 = {47 45 54 4f 46 46 45 52 53 41 52 52 41 59 } //GETOFFERSARRAY 1
$a_80_2 = {50 41 47 45 4f 46 46 45 52 41 43 54 49 56 41 54 45 } //PAGEOFFERACTIVATE 1
$a_80_3 = {49 4e 53 54 41 4c 4c 4f 46 46 45 52 53 } //INSTALLOFFERS 1
$a_80_4 = {43 48 45 43 4b 4f 46 46 45 52 } //CHECKOFFER 1
$a_80_5 = {50 41 47 45 4f 46 46 45 52 42 41 43 4b 42 55 54 54 4f 4e 43 4c 49 43 4b } //PAGEOFFERBACKBUTTONCLICK 1
$a_80_6 = {50 41 47 45 4f 46 46 45 52 53 48 4f 55 4c 44 53 4b 49 50 50 41 47 45 } //PAGEOFFERSHOULDSKIPPAGE 1
$a_80_7 = {50 52 4f 43 45 53 53 4f 46 46 45 52 53 54 52 49 4e 47 53 } //PROCESSOFFERSTRINGS 1
$a_80_8 = {47 45 54 41 44 53 45 52 56 45 52 52 45 53 50 4f 4e 53 45 } //GETADSERVERRESPONSE 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=7
}
rule _#PUA_Block_OfferCore_10{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 00 "
strings :
$a_00_0 = {47 45 54 4f 46 46 45 52 53 41 52 52 41 59 } //1 GETOFFERSARRAY
$a_00_1 = {47 45 54 49 4e 4a 45 43 54 45 44 50 41 52 41 4d } //1 GETINJECTEDPARAM
$a_00_2 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //1 GETOFFERINDEXBYPAGE
$a_00_3 = {50 41 47 45 4f 46 46 45 52 43 52 45 41 54 45 } //1 PAGEOFFERCREATE
$a_00_4 = {50 61 67 65 4f 66 66 65 72 41 63 74 69 76 61 74 65 } //1 PageOfferActivate
$a_80_5 = {63 61 6d 70 61 69 67 6e 5f 69 64 3d 6b 6f 68 6f 74 73 70 6f 74 2d 73 68 69 65 6c 64 } //campaign_id=kohotspot-shield 1
$a_80_6 = {4f 70 65 72 61 5c 6f 70 65 72 61 2e 65 78 65 } //Opera\opera.exe 1
$a_80_7 = {59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 } //Yandex\YandexBrowser 1
$a_80_8 = {63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f } //cloudfront.net/ 1
$a_80_9 = {49 6e 6e 6f 53 65 74 75 70 4c 64 72 57 69 6e 64 6f 77 } //InnoSetupLdrWindow 1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=9
}
rule _#PUA_Block_OfferCore_11{
meta:
description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 00 "
strings :
$a_80_0 = {53 45 54 42 55 4e 44 4c 45 4f 46 46 45 52 45 44 } //SETBUNDLEOFFERED 1
$a_80_1 = {44 4f 57 4e 4c 4f 41 44 42 55 4e 44 4c 45 } //DOWNLOADBUNDLE 1
$a_80_2 = {49 4e 53 54 41 4c 4c 42 55 4e 44 4c 45 } //INSTALLBUNDLE 1
$a_80_3 = {49 4e 53 54 41 4c 4c 41 43 43 45 50 54 45 44 42 55 4e 44 4c 45 53 } //INSTALLACCEPTEDBUNDLES 1
$a_80_4 = {4f 50 45 52 41 5f 4c 49 4e 4b 54 45 52 4d 53 43 4c 49 43 4b 45 44 } //OPERA_LINKTERMSCLICKED 1
$a_80_5 = {4f 50 45 52 41 5f 4c 49 4e 4b 50 4f 4c 49 43 59 43 4c 49 43 4b 45 44 } //OPERA_LINKPOLICYCLICKED 1
$a_80_6 = {43 52 45 41 54 45 4f 50 45 52 41 50 41 47 45 } //CREATEOPERAPAGE 1
$a_80_7 = {41 56 33 36 30 5f 4c 49 4e 4b 54 45 52 4d 53 43 4c 49 43 4b 45 44 } //AV360_LINKTERMSCLICKED 1
$a_80_8 = {41 56 33 36 30 5f 4c 49 4e 4b 50 4f 4c 49 43 59 43 4c 49 43 4b 45 44 } //AV360_LINKPOLICYCLICKED 1
$a_80_9 = {43 52 45 41 54 45 41 56 33 36 30 50 41 47 45 } //CREATEAV360PAGE 1
$a_80_10 = {6d 65 6e 74 61 6c 6d 65 6e 74 6f 72 2e 65 78 65 } //mentalmentor.exe 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1) >=11
}
#PUA/Block/_#PUA_Block_Presenoker.yar
+37 -37
View File
@@ -1,38 +1,38 @@
rule _#PUA_Block_Presenoker{
meta:
description = "!#PUA:Block:Presenoker,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {68 00 74 00 61 00 67 00 7a 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2e 00 70 00 77 00 } //1 htagzdownload.pw
$a_01_1 = {73 00 70 00 61 00 63 00 65 00 31 00 2e 00 61 00 64 00 6d 00 69 00 6e 00 70 00 72 00 65 00 73 00 73 00 75 00 72 00 65 00 2e 00 73 00 70 00 61 00 63 00 65 00 } //1 space1.adminpressure.space
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
rule _#PUA_Block_Presenoker_2{
meta:
description = "!#PUA:Block:Presenoker,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {68 74 74 70 3a 2f 2f 61 64 70 6c 75 73 2e 63 68 6c 62 69 7a 2e 63 6f 6d 2f 61 64 70 6c 75 73 2d 61 70 69 } //1 http://adplus.chlbiz.com/adplus-api
$a_01_1 = {68 74 74 70 3a 2f 2f 70 64 61 70 69 2e 7a 6e 79 73 68 75 72 75 66 61 2e 63 6f 6d 2f 63 69 74 79 } //1 http://pdapi.znyshurufa.com/city
$a_01_2 = {46 00 49 00 44 00 44 00 4c 00 45 00 52 00 } //1 FIDDLER
$a_01_3 = {57 00 49 00 52 00 45 00 53 00 48 00 41 00 52 00 4b 00 } //1 WIRESHARK
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
rule _#PUA_Block_Presenoker_3{
meta:
description = "!#PUA:Block:Presenoker,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {43 72 65 61 74 65 64 20 77 69 74 68 20 47 49 4d 50 } //1 Created with GIMP
$a_01_1 = {47 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 67 6c 65 2e 55 73 65 72 43 6f 6e 74 72 6f 6c 31 } //1 Goooooooooogle.UserControl1
$a_01_2 = {52 00 45 00 47 00 20 00 41 00 44 00 44 00 20 00 48 00 4b 00 43 00 55 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 54 00 52 00 32 00 20 00 2f 00 76 00 20 00 75 00 6e 00 69 00 20 00 2f 00 74 00 20 00 52 00 45 00 47 00 5f 00 53 00 5a 00 20 00 2f 00 64 00 20 00 31 00 } //1 REG ADD HKCU\Software\TR2 /v uni /t REG_SZ /d 1
$a_01_3 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 76 00 69 00 64 00 65 00 6f 00 63 00 6f 00 64 00 65 00 63 00 78 00 76 00 69 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 74 00 72 00 61 00 63 00 6b 00 2f 00 64 00 69 00 73 00 70 00 6c 00 61 00 79 00 2e 00 70 00 68 00 70 00 } //1 http://videocodecxvid.com/track/display.php
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule _#PUA_Block_Presenoker{
meta:
description = "!#PUA:Block:Presenoker,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {68 00 74 00 61 00 67 00 7a 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2e 00 70 00 77 00 } //1 htagzdownload.pw
$a_01_1 = {73 00 70 00 61 00 63 00 65 00 31 00 2e 00 61 00 64 00 6d 00 69 00 6e 00 70 00 72 00 65 00 73 00 73 00 75 00 72 00 65 00 2e 00 73 00 70 00 61 00 63 00 65 00 } //1 space1.adminpressure.space
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
rule _#PUA_Block_Presenoker_2{
meta:
description = "!#PUA:Block:Presenoker,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {68 74 74 70 3a 2f 2f 61 64 70 6c 75 73 2e 63 68 6c 62 69 7a 2e 63 6f 6d 2f 61 64 70 6c 75 73 2d 61 70 69 } //1 http://adplus.chlbiz.com/adplus-api
$a_01_1 = {68 74 74 70 3a 2f 2f 70 64 61 70 69 2e 7a 6e 79 73 68 75 72 75 66 61 2e 63 6f 6d 2f 63 69 74 79 } //1 http://pdapi.znyshurufa.com/city
$a_01_2 = {46 00 49 00 44 00 44 00 4c 00 45 00 52 00 } //1 FIDDLER
$a_01_3 = {57 00 49 00 52 00 45 00 53 00 48 00 41 00 52 00 4b 00 } //1 WIRESHARK
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
rule _#PUA_Block_Presenoker_3{
meta:
description = "!#PUA:Block:Presenoker,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {43 72 65 61 74 65 64 20 77 69 74 68 20 47 49 4d 50 } //1 Created with GIMP
$a_01_1 = {47 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 67 6c 65 2e 55 73 65 72 43 6f 6e 74 72 6f 6c 31 } //1 Goooooooooogle.UserControl1
$a_01_2 = {52 00 45 00 47 00 20 00 41 00 44 00 44 00 20 00 48 00 4b 00 43 00 55 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 54 00 52 00 32 00 20 00 2f 00 76 00 20 00 75 00 6e 00 69 00 20 00 2f 00 74 00 20 00 52 00 45 00 47 00 5f 00 53 00 5a 00 20 00 2f 00 64 00 20 00 31 00 } //1 REG ADD HKCU\Software\TR2 /v uni /t REG_SZ /d 1
$a_01_3 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 76 00 69 00 64 00 65 00 6f 00 63 00 6f 00 64 00 65 00 63 00 78 00 76 00 69 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 74 00 72 00 61 00 63 00 6b 00 2f 00 64 00 69 00 73 00 70 00 6c 00 61 00 79 00 2e 00 70 00 68 00 70 00 } //1 http://videocodecxvid.com/track/display.php
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
#PUA/Block/_#PUA_Block_Softcnapp.yar
+455 -455
View File
@@ -1,456 +1,456 @@
rule _#PUA_Block_Softcnapp{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {35 31 78 75 61 6e 62 69 6e } //51xuanbin 1
$a_80_1 = {43 49 63 6f 50 72 6f 2e 65 78 65 } //CIcoPro.exe 1
$a_80_2 = {74 6a 2e 70 65 69 6c 61 6e 63 61 6f 2e 63 6e } //tj.peilancao.cn 1
$a_80_3 = {43 6c 69 50 72 61 5f 49 6e 5f } //CliPra_In_ 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_2{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {73 6f 67 6f 75 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //sogouexplorer.exe 1
$a_80_1 = {43 6c 6f 76 65 72 2e 65 78 65 } //Clover.exe 1
$a_80_2 = {65 6a 69 65 2e 6d 65 } //ejie.me 1
$a_80_3 = {75 70 64 6d 70 2e 73 68 75 73 77 2e 63 6f 6d } //updmp.shusw.com 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_3{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_80_0 = {63 68 69 6e 61 76 69 70 73 6f 66 74 2e 63 6f 6d } //chinavipsoft.com 1
$a_80_1 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_2 = {57 61 6e 4e 65 6e 67 5a 69 70 2e 69 6e 69 } //WanNengZip.ini 1
$a_80_3 = {55 6e 69 6e 73 74 46 69 6e 69 73 68 42 67 53 6b 69 6e } //UninstFinishBgSkin -10
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*-10) >=3
}
rule _#PUA_Block_Softcnapp_4{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_02_0 = {65 6c 65 70 68 61 6e 74 70 64 66 [0-0f] 2e 79 65 62 61 6e 6b 65 6a 69 2e 63 6e } //1
$a_80_1 = {45 68 50 44 46 } //EhPDF 1
$a_80_2 = {50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 45 6c 65 70 68 61 6e 74 } //Program Files\Elephant 1
$a_80_3 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -5
condition:
((#a_02_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*-5) >=3
}
rule _#PUA_Block_Softcnapp_5{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {74 6a 2e 70 65 69 6c 61 6e 63 61 6f 2e 63 6e } //tj.peilancao.cn 1
$a_80_1 = {2f 6c 6f 67 2f 73 65 6e 64 6d 73 67 2e 70 68 70 } ///log/sendmsg.php 1
$a_80_2 = {6c 6f 72 65 2e 65 78 65 } //lore.exe 1
$a_80_3 = {43 49 63 6f 50 72 6f 2e 65 78 65 } //CIcoPro.exe 1
$a_80_4 = {35 31 78 75 61 6e 62 69 6e 2e 65 78 65 } //51xuanbin.exe 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_6{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {52 61 63 63 6f 6f 6e 57 69 66 69 } //RaccoonWifi 1
$a_80_1 = {49 6e 73 74 61 6c 6c 50 61 74 68 } //InstallPath 1
$a_80_2 = {75 73 65 72 63 6f 6e 66 69 67 2e 69 6e 69 } //userconfig.ini 1
$a_80_3 = {52 61 63 63 6f 6f 6e 57 69 66 69 2e 69 6e 69 } //RaccoonWifi.ini 1
$a_80_4 = {52 61 63 63 6f 6f 6e 57 69 66 69 2e 63 66 67 } //RaccoonWifi.cfg 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_7{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {50 44 43 6f 6e 66 69 67 2e 65 78 65 } //PDConfig.exe 1
$a_80_1 = {77 6e 69 65 2e 65 78 65 } //wnie.exe 1
$a_80_2 = {73 6f 67 6f 75 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //sogouexplorer.exe 1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_4 = {50 75 64 64 69 6e 67 44 65 73 6b 74 6f 70 2e 69 6e 69 } //PuddingDesktop.ini 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_8{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_80_0 = {77 63 2e 77 6e 35 31 2e 63 6f 6d 2f 77 6b 62 67 6c 2e 70 68 70 } //wc.wn51.com/wkbgl.php 2
$a_80_1 = {4c 6f 63 61 6c 4c 6f 77 5c 53 68 6b 62 5c 43 6f 6e 66 69 67 2e 69 6e 69 } //LocalLow\Shkb\Config.ini 1
$a_80_2 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_3 = {57 61 6e 4e 65 6e 67 49 6e 73 74 61 6c 6c 2e 70 64 62 } //WanNengInstall.pdb 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_9{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {62 61 63 6b 73 74 61 67 65 77 77 77 2e 77 6e 77 62 2e 63 6f 6d } //backstagewww.wnwb.com 2
$a_80_1 = {57 6e 55 73 65 72 50 61 67 65 2e 65 78 65 } //WnUserPage.exe 1
$a_80_2 = {53 6f 66 74 53 6b 69 6e } //SoftSkin 1
$a_80_3 = {57 61 6e 4e 65 6e 67 57 42 49 4d 45 2e 75 73 65 72 73 } //WanNengWBIME.users 1
$a_80_4 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_10{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {77 6e 77 62 2e 65 78 65 } //wnwb.exe 2
$a_80_1 = {74 6a 74 76 33 2e 77 6e 35 31 2e 63 6f 6d } //tjtv3.wn51.com 1
$a_80_2 = {77 77 77 2e 77 6e 77 62 2e 63 6f 6d 2f 70 6f 6c 69 63 79 2e 68 74 6d 6c } //www.wnwb.com/policy.html 1
$a_80_3 = {57 61 6e 4e 65 6e 67 57 42 49 6e 66 6f 2e 69 6e 69 } //WanNengWBInfo.ini 1
$a_80_4 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_11{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_80_0 = {43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 58 73 50 69 63 74 75 72 65 5c 58 73 50 69 63 4d 65 61 6e 73 2e 65 78 65 } //C:\Program Files\XsPicture\XsPicMeans.exe 1
$a_80_1 = {7a 79 63 75 6c 74 75 72 61 2e 63 6f 6d } //zycultura.com 1
$a_80_2 = {58 73 50 69 63 49 6e 66 6f 2e 69 6e 69 } //XsPicInfo.ini 1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_4 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -5
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-5) >=4
}
rule _#PUA_Block_Softcnapp_12{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_80_0 = {58 69 6e 53 75 5a 69 70 2e 69 6e 69 } //XinSuZip.ini 2
$a_80_1 = {74 6a 69 2e 7a 68 69 6c 69 6e 67 73 68 69 64 61 69 2e 63 6f 6d } //tji.zhilingshidai.com 2
$a_80_2 = {64 6f 77 6e 2e 7a 68 69 6c 69 6e 67 73 68 69 64 61 69 2e 63 6f 6d } //down.zhilingshidai.com 1
$a_80_3 = {55 73 65 49 6e 66 6f 2e 69 6e 69 } //UseInfo.ini 1
$a_80_4 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_5 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100) >=5
}
rule _#PUA_Block_Softcnapp_13{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_80_0 = {4d 47 57 61 6c 6c 70 61 70 65 72 } //MGWallpaper 1
$a_80_1 = {43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 4d 47 57 61 6c 6c 70 61 70 65 72 5c } //C:\Program Files\MGWallpaper\ 1
$a_00_2 = {73 6f 66 74 74 6a 2e 70 61 6e 73 68 69 78 6b 2e 63 6f 6d } //1 softtj.panshixk.com
$a_80_3 = {4d 67 57 61 6c 6c 2e 65 78 65 } //MgWall.exe 1
$a_80_4 = {50 65 72 73 69 73 74 42 61 72 5f 4f 6e 43 6f 6e 74 69 6e 75 65 55 6e 69 6e 73 74 } //PersistBar_OnContinueUninst -5
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_00_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-5) >=4
}
rule _#PUA_Block_Softcnapp_14{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {64 6f 77 6e 64 63 64 6e 2e 6a 69 61 2d 73 69 2e 63 6e 2f 63 66 67 2e 64 61 74 } //downdcdn.jia-si.cn/cfg.dat 1
$a_80_1 = {77 63 2e 6a 69 61 2d 73 69 2e 63 6e 2f 77 6b 62 67 6c 2e 70 68 70 } //wc.jia-si.cn/wkbgl.php 1
$a_80_2 = {5a 68 75 44 6f 6e 67 46 61 6e 67 59 75 2e 65 78 65 } //ZhuDongFangYu.exe 1
$a_80_3 = {5c 4c 6f 63 61 6c 4c 6f 77 5c 53 68 6b 62 5c 43 6f 6e 66 69 67 2e 69 6e 69 } //\LocalLow\Shkb\Config.ini 1
$a_80_4 = {77 6e 73 6f 66 74 2e 69 6e 69 } //wnsoft.ini 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_15{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 "
strings :
$a_80_0 = {73 6f 66 74 2e 78 73 66 61 79 61 2e 63 6f 6d 2f 6d 69 6e 69 2f 70 72 69 63 65 } //soft.xsfaya.com/mini/price 1
$a_80_1 = {43 3a 5c 4e 6f 53 68 6f 77 48 74 74 70 43 6f 6e 74 65 2e 6e 74 6c } //C:\NoShowHttpConte.ntl 1
$a_80_2 = {4d 69 6e 69 50 61 67 65 2e 65 78 65 } //MiniPage.exe 1
$a_80_3 = {6f 74 74 2e 78 73 66 61 79 61 2e 63 6f 6d } //ott.xsfaya.com 1
$a_80_4 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_5 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100) >=4
}
rule _#PUA_Block_Softcnapp_16{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 00 "
strings :
$a_80_0 = {58 73 50 69 63 49 6e 66 6f 2e 69 6e 69 } //XsPicInfo.ini 2
$a_80_1 = {7a 79 63 75 6c 74 75 72 61 2e 63 6f 6d } //zycultura.com 2
$a_80_2 = {58 73 50 69 63 56 69 65 77 } //XsPicView 1
$a_02_3 = {58 00 73 00 50 00 69 00 63 00 [0-0f] 2e 00 65 00 78 00 65 00 } //1
$a_02_4 = {58 73 50 69 63 [0-0f] 2e 65 78 65 } //1
$a_80_5 = {58 73 50 69 63 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //XsPicUninstall.exe -100
$a_80_6 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_7 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100) >=5
}
rule _#PUA_Block_Softcnapp_17{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {68 74 74 70 3a 2f 2f 6d 6d 74 6b 6d 2e 7a 73 69 6e 63 65 72 2e 63 6f 6d 2f 70 64 66 2f 6a 69 6b 65 2f 33 32 66 63 32 62 34 32 64 35 35 36 61 33 38 37 64 31 63 39 34 34 62 64 30 64 35 33 30 61 32 62 2e 64 65 64 } //http://mmtkm.zsincer.com/pdf/jike/32fc2b42d556a387d1c944bd0d530a2b.ded 1
$a_80_1 = {4a 6b 52 74 72 6f 6e 2e 65 78 65 } //JkRtron.exe 1
$a_80_2 = {48 6f 6c 6c 6f 6e 2e 69 6e 69 } //Hollon.ini 1
$a_80_3 = {6d 69 6e 6b 65 72 6e 65 6c 5c 63 72 74 73 5c 75 63 72 74 5c 69 6e 63 5c 63 6f 72 65 63 72 74 5f 69 6e 74 65 72 6e 61 6c 5f 73 74 72 74 6f 78 2e 68 } //minkernel\crts\ucrt\inc\corecrt_internal_strtox.h 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_18{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {53 57 53 6b 69 6e 49 6e 73 74 2e 65 78 65 } //SWSkinInst.exe 1
$a_80_1 = {43 6f 6e 66 69 67 5c 55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //Config\UseVestige.ini 1
$a_80_2 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_3 = {53 6d 61 72 74 43 6c 6f 75 64 57 42 49 6e 66 6f 2e 69 6e 69 } //SmartCloudWBInfo.ini 1
$a_80_4 = {45 3a 5c 67 69 74 5c 73 68 75 72 75 66 61 5c 73 72 63 5c 49 6d 65 57 42 5c 42 75 6e 64 6c 65 73 5c 53 6d 61 72 74 43 6c 6f 75 64 5c 42 69 6e 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 53 6b 69 6e 52 65 67 33 32 2e 70 64 62 } //E:\git\shurufa\src\ImeWB\Bundles\SmartCloud\Bin\pdbmap\WanNeng\SkinReg32.pdb 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_19{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 00 "
strings :
$a_80_0 = {6c 61 6f 68 75 61 6e 67 6c 69 33 36 35 2e 63 6f 6d } //laohuangli365.com 2
$a_80_1 = {6e 73 6b 32 38 39 30 2e 74 6d 70 } //nsk2890.tmp 1
$a_80_2 = {6e 73 75 2e 74 6d 70 } //nsu.tmp 1
$a_80_3 = {41 64 6a 75 73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 73 } //AdjustTokenPrivileges 1
$a_80_4 = {53 65 53 68 75 74 64 6f 77 6e 50 72 69 76 69 6c 65 67 65 } //SeShutdownPrivilege 1
$a_80_5 = {44 65 73 74 72 6f 79 57 69 6e 64 6f 77 } //DestroyWindow 1
$a_80_6 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_7 = {55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 } //Uninstaller.exe -100
$a_80_8 = {55 6e 69 6e 73 74 61 6c 2e 65 78 65 } //Uninstal.exe -100
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100) >=6
}
rule _#PUA_Block_Softcnapp_20{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {6a 63 78 79 74 2e 63 61 6e 67 79 61 6b 65 6a 69 2e 63 6e 2f 69 6d 61 67 65 2f 69 6e 6b 2f 64 64 35 64 34 62 38 31 38 37 33 63 63 38 62 65 38 31 32 32 30 65 62 30 33 32 30 35 63 39 63 33 2e 62 62 66 } //jcxyt.cangyakeji.cn/image/ink/dd5d4b81873cc8be81220eb03205c9c3.bbf 1
$a_80_1 = {49 6e 6b 49 6d 67 45 73 65 2e 65 78 65 } //InkImgEse.exe 1
$a_80_2 = {49 6e 6b 49 6d 67 45 73 64 2e 64 6c 6c } //InkImgEsd.dll 1
$a_80_3 = {6d 69 6e 6b 65 72 6e 65 6c 5c 63 72 74 73 5c 75 63 72 74 5c 69 6e 63 5c 63 6f 72 65 63 72 74 5f 69 6e 74 65 72 6e 61 6c 5f 73 74 72 74 6f 78 2e 68 } //minkernel\crts\ucrt\inc\corecrt_internal_strtox.h 1
$a_80_4 = {49 69 76 52 69 70 } //IivRip 1
$a_80_5 = {49 69 76 52 69 70 2e 63 66 67 } //IivRip.cfg 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_Softcnapp_21{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {53 43 4d 75 74 75 61 6c 2e 65 78 65 } //SCMutual.exe 1
$a_80_1 = {53 43 43 6f 6e 66 69 67 2e 65 78 65 } //SCConfig.exe 1
$a_80_2 = {73 63 69 65 2e 65 78 65 } //scie.exe 1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_4 = {5c 54 72 75 6e 6b 50 59 5c 42 69 6e 5c 70 64 62 6d 61 70 5c 53 6d 61 72 74 43 6c 6f 75 64 5c 4d 6f 6e 69 74 65 72 33 32 2e 70 64 62 } //\TrunkPY\Bin\pdbmap\SmartCloud\Moniter32.pdb 1
$a_80_5 = {68 68 63 74 72 6c 2e 6f 63 78 } //hhctrl.ocx 1
$a_80_6 = {66 3a 5c 73 70 5c 76 63 74 6f 6f 6c 73 5c 76 63 37 6c 69 62 73 5c 73 68 69 70 5c 61 74 6c 6d 66 63 5c 73 72 63 5c 6d 66 63 5c 61 70 70 63 6f 72 65 2e 63 70 70 } //f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_Softcnapp_22{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 "
strings :
$a_80_0 = {43 72 65 61 74 65 50 6f 70 75 70 4d 65 6e 75 } //CreatePopupMenu 1
$a_80_1 = {43 4d 59 57 4e 44 5f 4d 49 4e 49 50 41 47 45 } //CMYWND_MINIPAGE 1
$a_80_2 = {43 4d 59 57 4e 44 5f 4d 49 4e 49 50 41 47 45 3d 50 6f 70 75 70 } //CMYWND_MINIPAGE=Popup 1
$a_80_3 = {41 50 50 5f 4d 49 4e 49 50 41 47 45 5f 45 58 45 3d 54 72 61 76 69 73 2e 65 78 65 } //APP_MINIPAGE_EXE=Travis.exe 1
$a_80_4 = {4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 } //MiniDumpWriteDump 1
$a_80_5 = {6f 70 74 2e 76 6b 75 70 64 66 2e 63 6f 6d } //opt.vkupdf.com 1
$a_80_6 = {42 65 73 74 5a 69 70 2e 65 78 65 } //BestZip.exe 1
$a_80_7 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_8 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100) >=7
}
rule _#PUA_Block_Softcnapp_23{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 00 "
strings :
$a_80_0 = {50 44 46 52 65 61 64 65 72 } //PDFReader 1
$a_80_1 = {50 44 46 56 69 65 77 } //PDFView 1
$a_80_2 = {5a 68 6f 6e 67 48 75 61 50 64 66 } //ZhongHuaPdf 1
$a_80_3 = {4a 4b 43 6f 76 55 70 64 } //JKCovUpd 1
$a_80_4 = {63 68 69 6e 61 76 69 70 73 6f 66 74 2e 63 6f 6d } //chinavipsoft.com 1
$a_80_5 = {7a 73 69 6e 63 65 72 2e 63 6f 6d } //zsincer.com 1
$a_80_6 = {53 6f 61 6f 64 77 61 69 66 65 2e 69 6e 69 } //Soaodwaife.ini 1
$a_80_7 = {4a 4b 43 6f 76 79 62 61 77 62 79 2e 69 6e 69 } //JKCovybawby.ini 1
$a_80_8 = {4a 69 6b 65 50 44 46 43 6f 6e 76 65 72 74 65 72 2e 69 6e 69 } //JikePDFConverter.ini 1
$a_80_9 = {5a 48 50 44 46 49 6e 66 6f 2e 69 6e 69 } //ZHPDFInfo.ini 1
$a_80_10 = {55 6e 69 6e 73 74 46 69 6e 69 73 68 42 67 53 6b 69 6e } //UninstFinishBgSkin -5
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*-5) >=3
}
rule _#PUA_Block_Softcnapp_24{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 00 "
strings :
$a_80_0 = {79 6d 6a 71 6e 2e 62 69 6a 69 61 74 75 2e 63 6f 6d } //ymjqn.bijiatu.com 1
$a_80_1 = {5a 68 6f 6e 67 58 69 61 6e 67 57 69 46 69 2e 69 6e 69 } //ZhongXiangWiFi.ini 1
$a_80_2 = {4b 6f 61 6c 61 57 61 6c 6c 2e 69 6e 69 } //KoalaWall.ini 1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_00_4 = {7a 6d 69 77 6e 2e 62 69 6a 69 61 74 75 2e 63 6f 6d } //1 zmiwn.bijiatu.com
$a_80_5 = {4e 69 75 58 69 61 6f 51 75 61 6e 2e 69 6e 69 } //NiuXiaoQuan.ini 1
$a_80_6 = {4e 58 51 53 68 6f 70 70 69 6e 67 2e 65 78 65 } //NXQShopping.exe 1
$a_80_7 = {46 6f 74 68 6f 6c 70 69 64 64 2e 69 6e 69 } //Fotholpidd.ini 1
$a_80_8 = {46 6c 69 72 74 63 6b 79 6f 75 73 } //Flirtckyous 1
$a_80_9 = {4d 75 6f 74 65 72 69 6e 65 2e 69 6e 69 } //Muoterine.ini 1
$a_80_10 = {59 61 72 6e 72 6f 75 6e 64 } //Yarnround 1
$a_80_11 = {55 6e 69 6e 73 74 46 69 6e 69 73 68 42 67 53 6b 69 6e } //UninstFinishBgSkin -5
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_00_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*-5) >=3
}
rule _#PUA_Block_Softcnapp_25{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {74 6a 73 6f 66 74 2e } //tjsoft. 1
$a_80_1 = {2f 66 64 6f 74 2e 70 68 70 3f 64 61 74 61 3d } ///fdot.php?data= 1
$a_00_2 = {6a 00 69 00 61 00 2d 00 73 00 69 00 2e 00 63 00 6e 00 2f 00 61 00 70 00 69 00 2e 00 70 00 68 00 70 00 } //1 jia-si.cn/api.php
$a_00_3 = {31 00 30 00 31 00 2e 00 33 00 37 00 2e 00 31 00 38 00 38 00 2e 00 34 00 32 00 2f 00 } //1 101.37.188.42/
$a_00_4 = {64 00 6f 00 77 00 6e 00 64 00 63 00 64 00 6e 00 2e 00 6a 00 69 00 61 00 2d 00 73 00 69 00 2e 00 63 00 6e 00 2f 00 78 00 69 00 61 00 7a 00 61 00 69 00 71 00 69 00 2f 00 78 00 69 00 61 00 7a 00 61 00 69 00 71 00 69 00 2e 00 68 00 74 00 6d 00 6c 00 } //1 downdcdn.jia-si.cn/xiazaiqi/xiazaiqi.html
$a_00_5 = {6b 00 78 00 65 00 74 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 7c 00 6b 00 78 00 65 00 73 00 63 00 6f 00 72 00 65 00 2e 00 65 00 78 00 65 00 } //1 kxetray.exe|kxescore.exe
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6
}
rule _#PUA_Block_Softcnapp_26{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 "
strings :
$a_80_0 = {5c 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 } //\Mixed\pdbmap\WanNeng\Install.pdb 1
$a_02_1 = {43 00 3a 00 5c 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 73 00 20 00 61 00 6e 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 5c 00 [0-0f] 5c 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 44 00 61 00 74 00 61 00 5c 00 42 00 75 00 6e 00 64 00 6c 00 65 00 42 00 69 00 6e 00 64 00 5c 00 } //1
$a_02_2 = {43 3a 5c 44 6f 63 75 6d 65 6e 74 73 20 61 6e 64 20 53 65 74 74 69 6e 67 73 5c [0-0f] 5c 41 70 70 6c 69 63 61 74 69 6f 6e 20 44 61 74 61 5c 42 75 6e 64 6c 65 42 69 6e 64 5c } //1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_02_4 = {64 00 6f 00 77 00 6e 00 2e 00 [0-1f] 2e 00 63 00 6f 00 6d 00 } //1
$a_02_5 = {64 6f 77 6e 2e [0-1f] 2e 63 6f 6d } //1
condition:
((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_80_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_27{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_80_0 = {5c 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 } //\Mixed\pdbmap\WanNeng\Install.pdb 2
$a_02_1 = {43 00 3a 00 5c 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 73 00 20 00 61 00 6e 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 5c 00 [0-0f] 5c 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 44 00 61 00 74 00 61 00 5c 00 42 00 75 00 6e 00 64 00 6c 00 65 00 42 00 69 00 6e 00 64 00 5c 00 } //1
$a_02_2 = {43 3a 5c 44 6f 63 75 6d 65 6e 74 73 20 61 6e 64 20 53 65 74 74 69 6e 67 73 5c [0-0f] 5c 41 70 70 6c 69 63 61 74 69 6f 6e 20 44 61 74 61 5c 42 75 6e 64 6c 65 42 69 6e 64 5c } //1
$a_02_3 = {64 00 6f 00 77 00 6e 00 2e 00 [0-1f] 2e 00 63 00 6f 00 6d 00 } //2
$a_02_4 = {64 6f 77 6e 2e [0-1f] 2e 63 6f 6d } //2
$a_80_5 = {20 51 51 50 43 54 72 61 79 2e 65 78 65 } // QQPCTray.exe 1
$a_80_6 = {77 6e 73 6f 66 74 2e 69 6e 69 } //wnsoft.ini 1
condition:
((#a_80_0 & 1)*2+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*2+(#a_02_4 & 1)*2+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_28{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 00 "
strings :
$a_01_0 = {0f 10 84 f5 74 ff ff ff 8b 8d 38 ff ff ff 83 ec 10 0f 11 04 24 e8 84 bb f7 ff 83 c6 02 3b f7 7c df } //1
$a_01_1 = {0f 10 84 f5 74 ff ff ff 8b 8d 38 ff ff ff 83 ec 10 0f 11 04 24 e8 b6 bb f7 ff 83 c6 02 3b f7 7c df } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1
}
rule _#PUA_Block_Softcnapp_29{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {65 73 74 2e 63 6f 6d 2f 77 75 6d 69 6e 67 2f 70 6e 67 2f 6d 6f 6e 69 64 73 2e 70 6e 67 } //1 est.com/wuming/png/monids.png
$a_01_1 = {64 77 6f 6e 6c 6f 61 64 2e 73 69 6e 6f 73 74 65 65 6c 69 6e 76 65 73 74 2e 63 6f 6d } //1 dwonload.sinosteelinvest.com
$a_01_2 = {44 3a 5c 58 69 61 5a 61 69 51 69 5c 50 72 6f 6a 65 63 74 43 6f 70 79 5c 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 } //1 D:\XiaZaiQi\ProjectCopy\Mixed\pdbmap\WanNeng\Install.pdb
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
rule _#PUA_Block_Softcnapp_30{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 00 "
strings :
$a_01_0 = {5c 54 72 75 6e 6b 50 59 5c 42 69 6e 5c 70 64 62 6d 61 70 5c 53 6d 61 72 74 43 6c 6f 75 64 5c 4d 75 74 75 61 6c 33 32 2e 70 64 62 } //1 \TrunkPY\Bin\pdbmap\SmartCloud\Mutual32.pdb
$a_01_1 = {53 43 4d 75 74 75 61 6c 2e 65 78 65 } //1 SCMutual.exe
$a_01_2 = {2e 00 7a 00 6e 00 73 00 68 00 75 00 72 00 75 00 2e 00 63 00 6f 00 6d 00 } //1 .znshuru.com
$a_01_3 = {74 6a 74 76 33 2e 7a 6e 79 73 68 75 72 75 66 61 2e 63 6f 6d 2f } //1 tjtv3.znyshurufa.com/
$a_01_4 = {73 00 70 00 61 00 72 00 6b 00 2e 00 65 00 78 00 65 00 74 00 68 00 65 00 77 00 6f 00 72 00 6c 00 64 00 2e 00 65 00 78 00 65 00 } //1 spark.exetheworld.exe
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_31{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {74 6a 69 2e 6c 65 69 73 75 72 65 6c 79 70 61 6e 64 61 2e 63 6f 6d } //1 tji.leisurelypanda.com
$a_01_1 = {5c 00 42 00 75 00 6e 00 64 00 6c 00 65 00 73 00 5c 00 4c 00 69 00 74 00 74 00 6c 00 65 00 5c 00 53 00 6f 00 66 00 74 00 53 00 6b 00 69 00 6e 00 } //1 \Bundles\Little\SoftSkin
$a_01_2 = {4c 00 69 00 74 00 74 00 6c 00 65 00 50 00 69 00 63 00 } //1 LittlePic
$a_01_3 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 4c 00 69 00 74 00 74 00 6c 00 65 00 50 00 69 00 63 00 74 00 75 00 72 00 65 00 } //1 C:\Program Files\LittlePicture
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule _#PUA_Block_Softcnapp{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {35 31 78 75 61 6e 62 69 6e } //51xuanbin 1
$a_80_1 = {43 49 63 6f 50 72 6f 2e 65 78 65 } //CIcoPro.exe 1
$a_80_2 = {74 6a 2e 70 65 69 6c 61 6e 63 61 6f 2e 63 6e } //tj.peilancao.cn 1
$a_80_3 = {43 6c 69 50 72 61 5f 49 6e 5f } //CliPra_In_ 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_2{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {73 6f 67 6f 75 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //sogouexplorer.exe 1
$a_80_1 = {43 6c 6f 76 65 72 2e 65 78 65 } //Clover.exe 1
$a_80_2 = {65 6a 69 65 2e 6d 65 } //ejie.me 1
$a_80_3 = {75 70 64 6d 70 2e 73 68 75 73 77 2e 63 6f 6d } //updmp.shusw.com 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_3{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_80_0 = {63 68 69 6e 61 76 69 70 73 6f 66 74 2e 63 6f 6d } //chinavipsoft.com 1
$a_80_1 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_2 = {57 61 6e 4e 65 6e 67 5a 69 70 2e 69 6e 69 } //WanNengZip.ini 1
$a_80_3 = {55 6e 69 6e 73 74 46 69 6e 69 73 68 42 67 53 6b 69 6e } //UninstFinishBgSkin -10
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*-10) >=3
}
rule _#PUA_Block_Softcnapp_4{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 "
strings :
$a_02_0 = {65 6c 65 70 68 61 6e 74 70 64 66 [0-0f] 2e 79 65 62 61 6e 6b 65 6a 69 2e 63 6e } //1
$a_80_1 = {45 68 50 44 46 } //EhPDF 1
$a_80_2 = {50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 45 6c 65 70 68 61 6e 74 } //Program Files\Elephant 1
$a_80_3 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -5
condition:
((#a_02_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*-5) >=3
}
rule _#PUA_Block_Softcnapp_5{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {74 6a 2e 70 65 69 6c 61 6e 63 61 6f 2e 63 6e } //tj.peilancao.cn 1
$a_80_1 = {2f 6c 6f 67 2f 73 65 6e 64 6d 73 67 2e 70 68 70 } ///log/sendmsg.php 1
$a_80_2 = {6c 6f 72 65 2e 65 78 65 } //lore.exe 1
$a_80_3 = {43 49 63 6f 50 72 6f 2e 65 78 65 } //CIcoPro.exe 1
$a_80_4 = {35 31 78 75 61 6e 62 69 6e 2e 65 78 65 } //51xuanbin.exe 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_6{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {52 61 63 63 6f 6f 6e 57 69 66 69 } //RaccoonWifi 1
$a_80_1 = {49 6e 73 74 61 6c 6c 50 61 74 68 } //InstallPath 1
$a_80_2 = {75 73 65 72 63 6f 6e 66 69 67 2e 69 6e 69 } //userconfig.ini 1
$a_80_3 = {52 61 63 63 6f 6f 6e 57 69 66 69 2e 69 6e 69 } //RaccoonWifi.ini 1
$a_80_4 = {52 61 63 63 6f 6f 6e 57 69 66 69 2e 63 66 67 } //RaccoonWifi.cfg 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_7{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {50 44 43 6f 6e 66 69 67 2e 65 78 65 } //PDConfig.exe 1
$a_80_1 = {77 6e 69 65 2e 65 78 65 } //wnie.exe 1
$a_80_2 = {73 6f 67 6f 75 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //sogouexplorer.exe 1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_4 = {50 75 64 64 69 6e 67 44 65 73 6b 74 6f 70 2e 69 6e 69 } //PuddingDesktop.ini 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_8{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 "
strings :
$a_80_0 = {77 63 2e 77 6e 35 31 2e 63 6f 6d 2f 77 6b 62 67 6c 2e 70 68 70 } //wc.wn51.com/wkbgl.php 2
$a_80_1 = {4c 6f 63 61 6c 4c 6f 77 5c 53 68 6b 62 5c 43 6f 6e 66 69 67 2e 69 6e 69 } //LocalLow\Shkb\Config.ini 1
$a_80_2 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_3 = {57 61 6e 4e 65 6e 67 49 6e 73 74 61 6c 6c 2e 70 64 62 } //WanNengInstall.pdb 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_9{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {62 61 63 6b 73 74 61 67 65 77 77 77 2e 77 6e 77 62 2e 63 6f 6d } //backstagewww.wnwb.com 2
$a_80_1 = {57 6e 55 73 65 72 50 61 67 65 2e 65 78 65 } //WnUserPage.exe 1
$a_80_2 = {53 6f 66 74 53 6b 69 6e } //SoftSkin 1
$a_80_3 = {57 61 6e 4e 65 6e 67 57 42 49 4d 45 2e 75 73 65 72 73 } //WanNengWBIME.users 1
$a_80_4 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_10{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {77 6e 77 62 2e 65 78 65 } //wnwb.exe 2
$a_80_1 = {74 6a 74 76 33 2e 77 6e 35 31 2e 63 6f 6d } //tjtv3.wn51.com 1
$a_80_2 = {77 77 77 2e 77 6e 77 62 2e 63 6f 6d 2f 70 6f 6c 69 63 79 2e 68 74 6d 6c } //www.wnwb.com/policy.html 1
$a_80_3 = {57 61 6e 4e 65 6e 67 57 42 49 6e 66 6f 2e 69 6e 69 } //WanNengWBInfo.ini 1
$a_80_4 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_11{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_80_0 = {43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 58 73 50 69 63 74 75 72 65 5c 58 73 50 69 63 4d 65 61 6e 73 2e 65 78 65 } //C:\Program Files\XsPicture\XsPicMeans.exe 1
$a_80_1 = {7a 79 63 75 6c 74 75 72 61 2e 63 6f 6d } //zycultura.com 1
$a_80_2 = {58 73 50 69 63 49 6e 66 6f 2e 69 6e 69 } //XsPicInfo.ini 1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_4 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -5
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-5) >=4
}
rule _#PUA_Block_Softcnapp_12{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_80_0 = {58 69 6e 53 75 5a 69 70 2e 69 6e 69 } //XinSuZip.ini 2
$a_80_1 = {74 6a 69 2e 7a 68 69 6c 69 6e 67 73 68 69 64 61 69 2e 63 6f 6d } //tji.zhilingshidai.com 2
$a_80_2 = {64 6f 77 6e 2e 7a 68 69 6c 69 6e 67 73 68 69 64 61 69 2e 63 6f 6d } //down.zhilingshidai.com 1
$a_80_3 = {55 73 65 49 6e 66 6f 2e 69 6e 69 } //UseInfo.ini 1
$a_80_4 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_5 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100) >=5
}
rule _#PUA_Block_Softcnapp_13{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 "
strings :
$a_80_0 = {4d 47 57 61 6c 6c 70 61 70 65 72 } //MGWallpaper 1
$a_80_1 = {43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 4d 47 57 61 6c 6c 70 61 70 65 72 5c } //C:\Program Files\MGWallpaper\ 1
$a_00_2 = {73 6f 66 74 74 6a 2e 70 61 6e 73 68 69 78 6b 2e 63 6f 6d } //1 softtj.panshixk.com
$a_80_3 = {4d 67 57 61 6c 6c 2e 65 78 65 } //MgWall.exe 1
$a_80_4 = {50 65 72 73 69 73 74 42 61 72 5f 4f 6e 43 6f 6e 74 69 6e 75 65 55 6e 69 6e 73 74 } //PersistBar_OnContinueUninst -5
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_00_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-5) >=4
}
rule _#PUA_Block_Softcnapp_14{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {64 6f 77 6e 64 63 64 6e 2e 6a 69 61 2d 73 69 2e 63 6e 2f 63 66 67 2e 64 61 74 } //downdcdn.jia-si.cn/cfg.dat 1
$a_80_1 = {77 63 2e 6a 69 61 2d 73 69 2e 63 6e 2f 77 6b 62 67 6c 2e 70 68 70 } //wc.jia-si.cn/wkbgl.php 1
$a_80_2 = {5a 68 75 44 6f 6e 67 46 61 6e 67 59 75 2e 65 78 65 } //ZhuDongFangYu.exe 1
$a_80_3 = {5c 4c 6f 63 61 6c 4c 6f 77 5c 53 68 6b 62 5c 43 6f 6e 66 69 67 2e 69 6e 69 } //\LocalLow\Shkb\Config.ini 1
$a_80_4 = {77 6e 73 6f 66 74 2e 69 6e 69 } //wnsoft.ini 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_15{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 "
strings :
$a_80_0 = {73 6f 66 74 2e 78 73 66 61 79 61 2e 63 6f 6d 2f 6d 69 6e 69 2f 70 72 69 63 65 } //soft.xsfaya.com/mini/price 1
$a_80_1 = {43 3a 5c 4e 6f 53 68 6f 77 48 74 74 70 43 6f 6e 74 65 2e 6e 74 6c } //C:\NoShowHttpConte.ntl 1
$a_80_2 = {4d 69 6e 69 50 61 67 65 2e 65 78 65 } //MiniPage.exe 1
$a_80_3 = {6f 74 74 2e 78 73 66 61 79 61 2e 63 6f 6d } //ott.xsfaya.com 1
$a_80_4 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_5 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100) >=4
}
rule _#PUA_Block_Softcnapp_16{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 00 "
strings :
$a_80_0 = {58 73 50 69 63 49 6e 66 6f 2e 69 6e 69 } //XsPicInfo.ini 2
$a_80_1 = {7a 79 63 75 6c 74 75 72 61 2e 63 6f 6d } //zycultura.com 2
$a_80_2 = {58 73 50 69 63 56 69 65 77 } //XsPicView 1
$a_02_3 = {58 00 73 00 50 00 69 00 63 00 [0-0f] 2e 00 65 00 78 00 65 00 } //1
$a_02_4 = {58 73 50 69 63 [0-0f] 2e 65 78 65 } //1
$a_80_5 = {58 73 50 69 63 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //XsPicUninstall.exe -100
$a_80_6 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_7 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100) >=5
}
rule _#PUA_Block_Softcnapp_17{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_80_0 = {68 74 74 70 3a 2f 2f 6d 6d 74 6b 6d 2e 7a 73 69 6e 63 65 72 2e 63 6f 6d 2f 70 64 66 2f 6a 69 6b 65 2f 33 32 66 63 32 62 34 32 64 35 35 36 61 33 38 37 64 31 63 39 34 34 62 64 30 64 35 33 30 61 32 62 2e 64 65 64 } //http://mmtkm.zsincer.com/pdf/jike/32fc2b42d556a387d1c944bd0d530a2b.ded 1
$a_80_1 = {4a 6b 52 74 72 6f 6e 2e 65 78 65 } //JkRtron.exe 1
$a_80_2 = {48 6f 6c 6c 6f 6e 2e 69 6e 69 } //Hollon.ini 1
$a_80_3 = {6d 69 6e 6b 65 72 6e 65 6c 5c 63 72 74 73 5c 75 63 72 74 5c 69 6e 63 5c 63 6f 72 65 63 72 74 5f 69 6e 74 65 72 6e 61 6c 5f 73 74 72 74 6f 78 2e 68 } //minkernel\crts\ucrt\inc\corecrt_internal_strtox.h 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_18{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_80_0 = {53 57 53 6b 69 6e 49 6e 73 74 2e 65 78 65 } //SWSkinInst.exe 1
$a_80_1 = {43 6f 6e 66 69 67 5c 55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //Config\UseVestige.ini 1
$a_80_2 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_3 = {53 6d 61 72 74 43 6c 6f 75 64 57 42 49 6e 66 6f 2e 69 6e 69 } //SmartCloudWBInfo.ini 1
$a_80_4 = {45 3a 5c 67 69 74 5c 73 68 75 72 75 66 61 5c 73 72 63 5c 49 6d 65 57 42 5c 42 75 6e 64 6c 65 73 5c 53 6d 61 72 74 43 6c 6f 75 64 5c 42 69 6e 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 53 6b 69 6e 52 65 67 33 32 2e 70 64 62 } //E:\git\shurufa\src\ImeWB\Bundles\SmartCloud\Bin\pdbmap\WanNeng\SkinReg32.pdb 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_19{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 00 "
strings :
$a_80_0 = {6c 61 6f 68 75 61 6e 67 6c 69 33 36 35 2e 63 6f 6d } //laohuangli365.com 2
$a_80_1 = {6e 73 6b 32 38 39 30 2e 74 6d 70 } //nsk2890.tmp 1
$a_80_2 = {6e 73 75 2e 74 6d 70 } //nsu.tmp 1
$a_80_3 = {41 64 6a 75 73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 73 } //AdjustTokenPrivileges 1
$a_80_4 = {53 65 53 68 75 74 64 6f 77 6e 50 72 69 76 69 6c 65 67 65 } //SeShutdownPrivilege 1
$a_80_5 = {44 65 73 74 72 6f 79 57 69 6e 64 6f 77 } //DestroyWindow 1
$a_80_6 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_7 = {55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 } //Uninstaller.exe -100
$a_80_8 = {55 6e 69 6e 73 74 61 6c 2e 65 78 65 } //Uninstal.exe -100
condition:
((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100) >=6
}
rule _#PUA_Block_Softcnapp_20{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {6a 63 78 79 74 2e 63 61 6e 67 79 61 6b 65 6a 69 2e 63 6e 2f 69 6d 61 67 65 2f 69 6e 6b 2f 64 64 35 64 34 62 38 31 38 37 33 63 63 38 62 65 38 31 32 32 30 65 62 30 33 32 30 35 63 39 63 33 2e 62 62 66 } //jcxyt.cangyakeji.cn/image/ink/dd5d4b81873cc8be81220eb03205c9c3.bbf 1
$a_80_1 = {49 6e 6b 49 6d 67 45 73 65 2e 65 78 65 } //InkImgEse.exe 1
$a_80_2 = {49 6e 6b 49 6d 67 45 73 64 2e 64 6c 6c } //InkImgEsd.dll 1
$a_80_3 = {6d 69 6e 6b 65 72 6e 65 6c 5c 63 72 74 73 5c 75 63 72 74 5c 69 6e 63 5c 63 6f 72 65 63 72 74 5f 69 6e 74 65 72 6e 61 6c 5f 73 74 72 74 6f 78 2e 68 } //minkernel\crts\ucrt\inc\corecrt_internal_strtox.h 1
$a_80_4 = {49 69 76 52 69 70 } //IivRip 1
$a_80_5 = {49 69 76 52 69 70 2e 63 66 67 } //IivRip.cfg 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6
}
rule _#PUA_Block_Softcnapp_21{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_80_0 = {53 43 4d 75 74 75 61 6c 2e 65 78 65 } //SCMutual.exe 1
$a_80_1 = {53 43 43 6f 6e 66 69 67 2e 65 78 65 } //SCConfig.exe 1
$a_80_2 = {73 63 69 65 2e 65 78 65 } //scie.exe 1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_80_4 = {5c 54 72 75 6e 6b 50 59 5c 42 69 6e 5c 70 64 62 6d 61 70 5c 53 6d 61 72 74 43 6c 6f 75 64 5c 4d 6f 6e 69 74 65 72 33 32 2e 70 64 62 } //\TrunkPY\Bin\pdbmap\SmartCloud\Moniter32.pdb 1
$a_80_5 = {68 68 63 74 72 6c 2e 6f 63 78 } //hhctrl.ocx 1
$a_80_6 = {66 3a 5c 73 70 5c 76 63 74 6f 6f 6c 73 5c 76 63 37 6c 69 62 73 5c 73 68 69 70 5c 61 74 6c 6d 66 63 5c 73 72 63 5c 6d 66 63 5c 61 70 70 63 6f 72 65 2e 63 70 70 } //f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp 1
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7
}
rule _#PUA_Block_Softcnapp_22{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 "
strings :
$a_80_0 = {43 72 65 61 74 65 50 6f 70 75 70 4d 65 6e 75 } //CreatePopupMenu 1
$a_80_1 = {43 4d 59 57 4e 44 5f 4d 49 4e 49 50 41 47 45 } //CMYWND_MINIPAGE 1
$a_80_2 = {43 4d 59 57 4e 44 5f 4d 49 4e 49 50 41 47 45 3d 50 6f 70 75 70 } //CMYWND_MINIPAGE=Popup 1
$a_80_3 = {41 50 50 5f 4d 49 4e 49 50 41 47 45 5f 45 58 45 3d 54 72 61 76 69 73 2e 65 78 65 } //APP_MINIPAGE_EXE=Travis.exe 1
$a_80_4 = {4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 } //MiniDumpWriteDump 1
$a_80_5 = {6f 70 74 2e 76 6b 75 70 64 66 2e 63 6f 6d } //opt.vkupdf.com 1
$a_80_6 = {42 65 73 74 5a 69 70 2e 65 78 65 } //BestZip.exe 1
$a_80_7 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100
$a_80_8 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100) >=7
}
rule _#PUA_Block_Softcnapp_23{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 00 "
strings :
$a_80_0 = {50 44 46 52 65 61 64 65 72 } //PDFReader 1
$a_80_1 = {50 44 46 56 69 65 77 } //PDFView 1
$a_80_2 = {5a 68 6f 6e 67 48 75 61 50 64 66 } //ZhongHuaPdf 1
$a_80_3 = {4a 4b 43 6f 76 55 70 64 } //JKCovUpd 1
$a_80_4 = {63 68 69 6e 61 76 69 70 73 6f 66 74 2e 63 6f 6d } //chinavipsoft.com 1
$a_80_5 = {7a 73 69 6e 63 65 72 2e 63 6f 6d } //zsincer.com 1
$a_80_6 = {53 6f 61 6f 64 77 61 69 66 65 2e 69 6e 69 } //Soaodwaife.ini 1
$a_80_7 = {4a 4b 43 6f 76 79 62 61 77 62 79 2e 69 6e 69 } //JKCovybawby.ini 1
$a_80_8 = {4a 69 6b 65 50 44 46 43 6f 6e 76 65 72 74 65 72 2e 69 6e 69 } //JikePDFConverter.ini 1
$a_80_9 = {5a 48 50 44 46 49 6e 66 6f 2e 69 6e 69 } //ZHPDFInfo.ini 1
$a_80_10 = {55 6e 69 6e 73 74 46 69 6e 69 73 68 42 67 53 6b 69 6e } //UninstFinishBgSkin -5
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*-5) >=3
}
rule _#PUA_Block_Softcnapp_24{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 00 "
strings :
$a_80_0 = {79 6d 6a 71 6e 2e 62 69 6a 69 61 74 75 2e 63 6f 6d } //ymjqn.bijiatu.com 1
$a_80_1 = {5a 68 6f 6e 67 58 69 61 6e 67 57 69 46 69 2e 69 6e 69 } //ZhongXiangWiFi.ini 1
$a_80_2 = {4b 6f 61 6c 61 57 61 6c 6c 2e 69 6e 69 } //KoalaWall.ini 1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_00_4 = {7a 6d 69 77 6e 2e 62 69 6a 69 61 74 75 2e 63 6f 6d } //1 zmiwn.bijiatu.com
$a_80_5 = {4e 69 75 58 69 61 6f 51 75 61 6e 2e 69 6e 69 } //NiuXiaoQuan.ini 1
$a_80_6 = {4e 58 51 53 68 6f 70 70 69 6e 67 2e 65 78 65 } //NXQShopping.exe 1
$a_80_7 = {46 6f 74 68 6f 6c 70 69 64 64 2e 69 6e 69 } //Fotholpidd.ini 1
$a_80_8 = {46 6c 69 72 74 63 6b 79 6f 75 73 } //Flirtckyous 1
$a_80_9 = {4d 75 6f 74 65 72 69 6e 65 2e 69 6e 69 } //Muoterine.ini 1
$a_80_10 = {59 61 72 6e 72 6f 75 6e 64 } //Yarnround 1
$a_80_11 = {55 6e 69 6e 73 74 46 69 6e 69 73 68 42 67 53 6b 69 6e } //UninstFinishBgSkin -5
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_00_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*-5) >=3
}
rule _#PUA_Block_Softcnapp_25{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_80_0 = {74 6a 73 6f 66 74 2e } //tjsoft. 1
$a_80_1 = {2f 66 64 6f 74 2e 70 68 70 3f 64 61 74 61 3d } ///fdot.php?data= 1
$a_00_2 = {6a 00 69 00 61 00 2d 00 73 00 69 00 2e 00 63 00 6e 00 2f 00 61 00 70 00 69 00 2e 00 70 00 68 00 70 00 } //1 jia-si.cn/api.php
$a_00_3 = {31 00 30 00 31 00 2e 00 33 00 37 00 2e 00 31 00 38 00 38 00 2e 00 34 00 32 00 2f 00 } //1 101.37.188.42/
$a_00_4 = {64 00 6f 00 77 00 6e 00 64 00 63 00 64 00 6e 00 2e 00 6a 00 69 00 61 00 2d 00 73 00 69 00 2e 00 63 00 6e 00 2f 00 78 00 69 00 61 00 7a 00 61 00 69 00 71 00 69 00 2f 00 78 00 69 00 61 00 7a 00 61 00 69 00 71 00 69 00 2e 00 68 00 74 00 6d 00 6c 00 } //1 downdcdn.jia-si.cn/xiazaiqi/xiazaiqi.html
$a_00_5 = {6b 00 78 00 65 00 74 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 7c 00 6b 00 78 00 65 00 73 00 63 00 6f 00 72 00 65 00 2e 00 65 00 78 00 65 00 } //1 kxetray.exe|kxescore.exe
condition:
((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6
}
rule _#PUA_Block_Softcnapp_26{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 "
strings :
$a_80_0 = {5c 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 } //\Mixed\pdbmap\WanNeng\Install.pdb 1
$a_02_1 = {43 00 3a 00 5c 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 73 00 20 00 61 00 6e 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 5c 00 [0-0f] 5c 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 44 00 61 00 74 00 61 00 5c 00 42 00 75 00 6e 00 64 00 6c 00 65 00 42 00 69 00 6e 00 64 00 5c 00 } //1
$a_02_2 = {43 3a 5c 44 6f 63 75 6d 65 6e 74 73 20 61 6e 64 20 53 65 74 74 69 6e 67 73 5c [0-0f] 5c 41 70 70 6c 69 63 61 74 69 6f 6e 20 44 61 74 61 5c 42 75 6e 64 6c 65 42 69 6e 64 5c } //1
$a_80_3 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1
$a_02_4 = {64 00 6f 00 77 00 6e 00 2e 00 [0-1f] 2e 00 63 00 6f 00 6d 00 } //1
$a_02_5 = {64 6f 77 6e 2e [0-1f] 2e 63 6f 6d } //1
condition:
((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_80_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_27{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_80_0 = {5c 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 } //\Mixed\pdbmap\WanNeng\Install.pdb 2
$a_02_1 = {43 00 3a 00 5c 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 73 00 20 00 61 00 6e 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 5c 00 [0-0f] 5c 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 44 00 61 00 74 00 61 00 5c 00 42 00 75 00 6e 00 64 00 6c 00 65 00 42 00 69 00 6e 00 64 00 5c 00 } //1
$a_02_2 = {43 3a 5c 44 6f 63 75 6d 65 6e 74 73 20 61 6e 64 20 53 65 74 74 69 6e 67 73 5c [0-0f] 5c 41 70 70 6c 69 63 61 74 69 6f 6e 20 44 61 74 61 5c 42 75 6e 64 6c 65 42 69 6e 64 5c } //1
$a_02_3 = {64 00 6f 00 77 00 6e 00 2e 00 [0-1f] 2e 00 63 00 6f 00 6d 00 } //2
$a_02_4 = {64 6f 77 6e 2e [0-1f] 2e 63 6f 6d } //2
$a_80_5 = {20 51 51 50 43 54 72 61 79 2e 65 78 65 } // QQPCTray.exe 1
$a_80_6 = {77 6e 73 6f 66 74 2e 69 6e 69 } //wnsoft.ini 1
condition:
((#a_80_0 & 1)*2+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*2+(#a_02_4 & 1)*2+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=5
}
rule _#PUA_Block_Softcnapp_28{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 00 "
strings :
$a_01_0 = {0f 10 84 f5 74 ff ff ff 8b 8d 38 ff ff ff 83 ec 10 0f 11 04 24 e8 84 bb f7 ff 83 c6 02 3b f7 7c df } //1
$a_01_1 = {0f 10 84 f5 74 ff ff ff 8b 8d 38 ff ff ff 83 ec 10 0f 11 04 24 e8 b6 bb f7 ff 83 c6 02 3b f7 7c df } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1
}
rule _#PUA_Block_Softcnapp_29{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {65 73 74 2e 63 6f 6d 2f 77 75 6d 69 6e 67 2f 70 6e 67 2f 6d 6f 6e 69 64 73 2e 70 6e 67 } //1 est.com/wuming/png/monids.png
$a_01_1 = {64 77 6f 6e 6c 6f 61 64 2e 73 69 6e 6f 73 74 65 65 6c 69 6e 76 65 73 74 2e 63 6f 6d } //1 dwonload.sinosteelinvest.com
$a_01_2 = {44 3a 5c 58 69 61 5a 61 69 51 69 5c 50 72 6f 6a 65 63 74 43 6f 70 79 5c 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 } //1 D:\XiaZaiQi\ProjectCopy\Mixed\pdbmap\WanNeng\Install.pdb
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
rule _#PUA_Block_Softcnapp_30{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 00 "
strings :
$a_01_0 = {5c 54 72 75 6e 6b 50 59 5c 42 69 6e 5c 70 64 62 6d 61 70 5c 53 6d 61 72 74 43 6c 6f 75 64 5c 4d 75 74 75 61 6c 33 32 2e 70 64 62 } //1 \TrunkPY\Bin\pdbmap\SmartCloud\Mutual32.pdb
$a_01_1 = {53 43 4d 75 74 75 61 6c 2e 65 78 65 } //1 SCMutual.exe
$a_01_2 = {2e 00 7a 00 6e 00 73 00 68 00 75 00 72 00 75 00 2e 00 63 00 6f 00 6d 00 } //1 .znshuru.com
$a_01_3 = {74 6a 74 76 33 2e 7a 6e 79 73 68 75 72 75 66 61 2e 63 6f 6d 2f } //1 tjtv3.znyshurufa.com/
$a_01_4 = {73 00 70 00 61 00 72 00 6b 00 2e 00 65 00 78 00 65 00 74 00 68 00 65 00 77 00 6f 00 72 00 6c 00 64 00 2e 00 65 00 78 00 65 00 } //1 spark.exetheworld.exe
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4
}
rule _#PUA_Block_Softcnapp_31{
meta:
description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {74 6a 69 2e 6c 65 69 73 75 72 65 6c 79 70 61 6e 64 61 2e 63 6f 6d } //1 tji.leisurelypanda.com
$a_01_1 = {5c 00 42 00 75 00 6e 00 64 00 6c 00 65 00 73 00 5c 00 4c 00 69 00 74 00 74 00 6c 00 65 00 5c 00 53 00 6f 00 66 00 74 00 53 00 6b 00 69 00 6e 00 } //1 \Bundles\Little\SoftSkin
$a_01_2 = {4c 00 69 00 74 00 74 00 6c 00 65 00 50 00 69 00 63 00 } //1 LittlePic
$a_01_3 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 4c 00 69 00 74 00 74 00 6c 00 65 00 50 00 69 00 63 00 74 00 75 00 72 00 65 00 } //1 C:\Program Files\LittlePicture
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
#attrmatch_rescan_psif/_#attrmatch_rescan_psif.yar
+88 -88
View File
@@ -1,89 +1,89 @@
rule _#attrmatch_rescan_psif{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_01_0 = {8b 40 28 83 c0 0e 66 8b 00 66 3b 45 e6 0f 84 } //1
condition:
((#a_01_0 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_2{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_03_0 = {8b 43 28 83 c0 ?? 66 8b 00 66 3b 45 e6 0f 84 4e 02 00 00 } //1
condition:
((#a_03_0 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_3{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 "
strings :
$a_01_0 = {0f 31 89 c3 0f 31 29 d8 77 fa } //10
$a_03_1 = {e8 00 00 00 00 58 89 45 ?? c6 45 ?? 59 c6 45 ?? 2a c6 45 ?? 38 } //1
condition:
((#a_01_0 & 1)*10+(#a_03_1 & 1)*1) >=11
}
rule _#attrmatch_rescan_psif_4{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 00 "
strings :
$a_03_0 = {51 c7 45 fc 02 00 00 00 e8 ?? ?? ?? ?? 85 c0 74 04 83 45 fc 06 8b 45 fc ff 14 85 } //1
$a_03_1 = {51 c7 45 fc 02 00 00 00 e8 ?? ?? ?? ?? 85 c0 74 09 8b 45 fc 83 c0 06 89 45 fc 8b 4d fc ff 14 8d } //1
$a_03_2 = {51 c7 04 24 02 00 00 00 e8 ?? ?? ?? ?? 85 c0 74 09 8b 04 24 83 c0 06 89 04 24 8b 0c 24 ff 14 8d } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_5{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 00 "
strings :
$a_01_0 = {56 69 72 41 6c 6c 78 00 6d 79 61 70 70 2e 65 78 65 } //1
$a_01_1 = {6d 79 61 70 70 2e 65 78 65 00 00 00 71 65 6d 75 } //1
$a_01_2 = {01 46 46 46 1f 5c 5c 5c 69 68 67 68 b9 73 72 73 } //1
$a_01_3 = {6d 79 61 70 70 2e 65 78 65 00 00 00 73 52 61 53 } //1
$a_03_4 = {6d 79 61 70 70 2e 65 78 65 00 00 00 00 53 00 4f 00 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 00 76 00 61 00 73 00 74 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_6{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 00 "
strings :
$a_03_0 = {64 8b 1d 30 00 00 00 89 5d fc 8b 45 fc 8b 40 0c 8b 70 0c 66 c7 45 ?? 70 00 66 c7 45 ?? 6d 00 66 c7 45 ?? 62 00 8b 46 28 } //1
$a_03_1 = {e8 00 00 00 00 58 89 45 ?? c6 45 ?? 59 c6 45 ?? 2a c6 45 ?? 38 33 (c0 40|d2 42) 8b 90 03 01 01 4d 75 90 1b 00 } //1
$a_03_2 = {66 8b 00 66 3b 85 ?? ?? ff ff 74 16 8b 45 ?? 8b 40 28 83 c0 06 66 8b 00 66 3b 85 ?? ?? ff ff 75 01 c3 } //1
$a_03_3 = {64 8b 15 30 00 00 00 89 55 fc 8b 45 fc 8b 40 0c 8b 48 0c 66 c7 85 ?? ?? ff ff ?? 00 66 c7 85 ?? ?? ff ff ?? 00 8b 41 28 } //1
$a_01_4 = {8b 5e 28 8b f8 03 ff 03 df 66 8b 1b 66 89 19 40 83 c1 02 4a 75 ea } //1
$a_03_5 = {8b 43 28 8b d0 83 c2 ?? 66 8b 12 66 3b 55 ?? 0f 84 ?? ?? ?? ?? 83 c0 ?? 66 8b 00 66 3b 45 ?? 0f 84 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1+(#a_03_5 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_7{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 00 "
strings :
$a_03_0 = {ff d7 c6 45 ?? 43 c6 45 ?? 6d c6 45 ?? 61 c6 45 ?? 2e 8a 85 ?? ?? ff ff 3a 45 ?? 75 ?? 8a 85 ?? ?? ff ff 3a 45 ?? 75 ?? 8a 85 ?? ?? ff ff 3a 45 ?? 75 ?? 8a 85 ?? ?? ff ff 3a 45 ?? 75 } //1
$a_03_1 = {66 8b 09 66 8b 55 ?? 66 3b ca 75 90 09 1d 00 66 c7 45 ?? 70 00 66 c7 45 ?? 6d 00 66 c7 45 ?? 62 00 8b 45 ?? 8b 40 ?? 8b c8 83 c1 0c } //1
$a_03_2 = {64 8b 05 30 00 00 00 89 45 ?? 8b 45 ?? 8b 40 0c 8b 70 0c 66 c7 45 ?? 6d 00 66 c7 45 ?? 61 00 8b 46 28 8b d0 83 c2 06 66 8b 12 66 3b 55 ?? 75 } //1
$a_03_3 = {64 8b 15 30 00 00 00 89 55 ?? 8b 45 ?? 8b 40 0c 8b 48 0c 66 c7 85 ?? ?? ff ff 90 04 01 05 6d 79 61 70 70 00 66 c7 85 ?? ?? ff ff 90 04 01 05 6d 79 61 70 70 00 8b 41 28 8b d0 83 c2 ?? 66 8b 12 66 3b 95 ?? ?? ff ff 75 } //1
$a_03_4 = {64 8b 15 30 00 00 00 89 55 ?? 8b 45 ?? 8b 40 0c 8b 48 0c 66 c7 85 ?? ?? ?? ?? 61 00 66 c7 85 ?? ?? ?? ?? 79 00 66 c7 85 ?? ?? ?? ?? 70 00 8b 41 28 8b d0 83 c2 ?? 66 8b 12 66 3b 95 ?? ?? ff ff 75 } //1
$a_03_5 = {64 8b 15 30 00 00 00 89 55 ?? 8b 45 ?? 8b 40 0c 8b 48 0c 66 c7 85 ?? ?? ?? ?? 70 00 8b 41 28 8b d0 83 c2 ?? 66 8b 12 66 3b 95 ?? ?? ?? ?? 75 } //1
$a_03_6 = {6d 00 66 c7 45 ?? 61 00 66 c7 45 ?? 78 00 8b 45 ?? 8b 40 28 8b d0 83 c2 06 66 8b 12 66 3b 55 ?? 75 1b 8b d0 83 c2 ?? 66 8b 12 66 3b 55 ?? 75 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=1
rule _#attrmatch_rescan_psif{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_01_0 = {8b 40 28 83 c0 0e 66 8b 00 66 3b 45 e6 0f 84 } //1
condition:
((#a_01_0 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_2{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_03_0 = {8b 43 28 83 c0 ?? 66 8b 00 66 3b 45 e6 0f 84 4e 02 00 00 } //1
condition:
((#a_03_0 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_3{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 "
strings :
$a_01_0 = {0f 31 89 c3 0f 31 29 d8 77 fa } //10
$a_03_1 = {e8 00 00 00 00 58 89 45 ?? c6 45 ?? 59 c6 45 ?? 2a c6 45 ?? 38 } //1
condition:
((#a_01_0 & 1)*10+(#a_03_1 & 1)*1) >=11
}
rule _#attrmatch_rescan_psif_4{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 00 "
strings :
$a_03_0 = {51 c7 45 fc 02 00 00 00 e8 ?? ?? ?? ?? 85 c0 74 04 83 45 fc 06 8b 45 fc ff 14 85 } //1
$a_03_1 = {51 c7 45 fc 02 00 00 00 e8 ?? ?? ?? ?? 85 c0 74 09 8b 45 fc 83 c0 06 89 45 fc 8b 4d fc ff 14 8d } //1
$a_03_2 = {51 c7 04 24 02 00 00 00 e8 ?? ?? ?? ?? 85 c0 74 09 8b 04 24 83 c0 06 89 04 24 8b 0c 24 ff 14 8d } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_5{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 00 "
strings :
$a_01_0 = {56 69 72 41 6c 6c 78 00 6d 79 61 70 70 2e 65 78 65 } //1
$a_01_1 = {6d 79 61 70 70 2e 65 78 65 00 00 00 71 65 6d 75 } //1
$a_01_2 = {01 46 46 46 1f 5c 5c 5c 69 68 67 68 b9 73 72 73 } //1
$a_01_3 = {6d 79 61 70 70 2e 65 78 65 00 00 00 73 52 61 53 } //1
$a_03_4 = {6d 79 61 70 70 2e 65 78 65 00 00 00 00 53 00 4f 00 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 00 76 00 61 00 73 00 74 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_6{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 00 "
strings :
$a_03_0 = {64 8b 1d 30 00 00 00 89 5d fc 8b 45 fc 8b 40 0c 8b 70 0c 66 c7 45 ?? 70 00 66 c7 45 ?? 6d 00 66 c7 45 ?? 62 00 8b 46 28 } //1
$a_03_1 = {e8 00 00 00 00 58 89 45 ?? c6 45 ?? 59 c6 45 ?? 2a c6 45 ?? 38 33 (c0 40|d2 42) 8b 90 03 01 01 4d 75 90 1b 00 } //1
$a_03_2 = {66 8b 00 66 3b 85 ?? ?? ff ff 74 16 8b 45 ?? 8b 40 28 83 c0 06 66 8b 00 66 3b 85 ?? ?? ff ff 75 01 c3 } //1
$a_03_3 = {64 8b 15 30 00 00 00 89 55 fc 8b 45 fc 8b 40 0c 8b 48 0c 66 c7 85 ?? ?? ff ff ?? 00 66 c7 85 ?? ?? ff ff ?? 00 8b 41 28 } //1
$a_01_4 = {8b 5e 28 8b f8 03 ff 03 df 66 8b 1b 66 89 19 40 83 c1 02 4a 75 ea } //1
$a_03_5 = {8b 43 28 8b d0 83 c2 ?? 66 8b 12 66 3b 55 ?? 0f 84 ?? ?? ?? ?? 83 c0 ?? 66 8b 00 66 3b 45 ?? 0f 84 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1+(#a_03_5 & 1)*1) >=1
}
rule _#attrmatch_rescan_psif_7{
meta:
description = "!#attrmatch_rescan_psif,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 00 "
strings :
$a_03_0 = {ff d7 c6 45 ?? 43 c6 45 ?? 6d c6 45 ?? 61 c6 45 ?? 2e 8a 85 ?? ?? ff ff 3a 45 ?? 75 ?? 8a 85 ?? ?? ff ff 3a 45 ?? 75 ?? 8a 85 ?? ?? ff ff 3a 45 ?? 75 ?? 8a 85 ?? ?? ff ff 3a 45 ?? 75 } //1
$a_03_1 = {66 8b 09 66 8b 55 ?? 66 3b ca 75 90 09 1d 00 66 c7 45 ?? 70 00 66 c7 45 ?? 6d 00 66 c7 45 ?? 62 00 8b 45 ?? 8b 40 ?? 8b c8 83 c1 0c } //1
$a_03_2 = {64 8b 05 30 00 00 00 89 45 ?? 8b 45 ?? 8b 40 0c 8b 70 0c 66 c7 45 ?? 6d 00 66 c7 45 ?? 61 00 8b 46 28 8b d0 83 c2 06 66 8b 12 66 3b 55 ?? 75 } //1
$a_03_3 = {64 8b 15 30 00 00 00 89 55 ?? 8b 45 ?? 8b 40 0c 8b 48 0c 66 c7 85 ?? ?? ff ff 90 04 01 05 6d 79 61 70 70 00 66 c7 85 ?? ?? ff ff 90 04 01 05 6d 79 61 70 70 00 8b 41 28 8b d0 83 c2 ?? 66 8b 12 66 3b 95 ?? ?? ff ff 75 } //1
$a_03_4 = {64 8b 15 30 00 00 00 89 55 ?? 8b 45 ?? 8b 40 0c 8b 48 0c 66 c7 85 ?? ?? ?? ?? 61 00 66 c7 85 ?? ?? ?? ?? 79 00 66 c7 85 ?? ?? ?? ?? 70 00 8b 41 28 8b d0 83 c2 ?? 66 8b 12 66 3b 95 ?? ?? ff ff 75 } //1
$a_03_5 = {64 8b 15 30 00 00 00 89 55 ?? 8b 45 ?? 8b 40 0c 8b 48 0c 66 c7 85 ?? ?? ?? ?? 70 00 8b 41 28 8b d0 83 c2 ?? 66 8b 12 66 3b 95 ?? ?? ?? ?? 75 } //1
$a_03_6 = {6d 00 66 c7 45 ?? 61 00 66 c7 45 ?? 78 00 8b 45 ?? 8b 40 28 8b d0 83 c2 06 66 8b 12 66 3b 55 ?? 75 1b 8b d0 83 c2 ?? 66 8b 12 66 3b 55 ?? 75 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=1
}
Adware/AndroidOS/ADLoad/Adware_AndroidOS_ADLoad_A_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_ADLoad_A_MTB{
meta:
description = "Adware:AndroidOS/ADLoad.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {46 75 6c 6c 53 63 72 65 65 6e 41 64 41 63 74 69 76 69 74 79 } //1 FullScreenAdActivity
$a_01_1 = {73 68 6f 75 6c 64 4f 76 65 72 72 69 64 65 55 72 6c 4c 6f 61 64 69 6e 67 } //1 shouldOverrideUrlLoading
$a_01_2 = {72 65 71 75 65 73 74 41 64 73 } //1 requestAds
$a_01_3 = {64 6f 77 6e 6c 6f 61 64 41 64 } //1 downloadAd
$a_01_4 = {70 6c 61 79 46 75 6c 6c 73 63 72 65 65 6e 41 64 } //1 playFullscreenAd
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_AndroidOS_ADLoad_A_MTB{
meta:
description = "Adware:AndroidOS/ADLoad.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {46 75 6c 6c 53 63 72 65 65 6e 41 64 41 63 74 69 76 69 74 79 } //1 FullScreenAdActivity
$a_01_1 = {73 68 6f 75 6c 64 4f 76 65 72 72 69 64 65 55 72 6c 4c 6f 61 64 69 6e 67 } //1 shouldOverrideUrlLoading
$a_01_2 = {72 65 71 75 65 73 74 41 64 73 } //1 requestAds
$a_01_3 = {64 6f 77 6e 6c 6f 61 64 41 64 } //1 downloadAd
$a_01_4 = {70 6c 61 79 46 75 6c 6c 73 63 72 65 65 6e 41 64 } //1 playFullscreenAd
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/AndroidOS/Adlo/Adware_AndroidOS_Adlo_A_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_Adlo_A_MTB{
meta:
description = "Adware:AndroidOS/Adlo.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,15 00 15 00 04 00 00 "
strings :
$a_03_0 = {1c 00 00 00 6e 10 ?? 01 01 00 0a 00 23 00 ?? 00 6e 20 ?? 01 01 00 6e 10 ?? 01 01 00 71 10 ?? 01 00 00 0c 01 6e 20 ?? 01 12 00 6e 10 ?? 01 02 00 } //10
$a_03_1 = {12 00 00 00 21 ?? 23 00 ?? 00 12 01 [0-05] 35 [0-03] 00 48 [0-08] 8d ?? 4f ?? 00 ?? d8 [0-03] 01 } //10
$a_00_2 = {63 72 65 61 74 65 4e 65 77 46 69 6c 65 } //1 createNewFile
$a_00_3 = {42 61 73 65 44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 BaseDexClassLoader
condition:
((#a_03_0 & 1)*10+(#a_03_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=21
rule Adware_AndroidOS_Adlo_A_MTB{
meta:
description = "Adware:AndroidOS/Adlo.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,15 00 15 00 04 00 00 "
strings :
$a_03_0 = {1c 00 00 00 6e 10 ?? 01 01 00 0a 00 23 00 ?? 00 6e 20 ?? 01 01 00 6e 10 ?? 01 01 00 71 10 ?? 01 00 00 0c 01 6e 20 ?? 01 12 00 6e 10 ?? 01 02 00 } //10
$a_03_1 = {12 00 00 00 21 ?? 23 00 ?? 00 12 01 [0-05] 35 [0-03] 00 48 [0-08] 8d ?? 4f ?? 00 ?? d8 [0-03] 01 } //10
$a_00_2 = {63 72 65 61 74 65 4e 65 77 46 69 6c 65 } //1 createNewFile
$a_00_3 = {42 61 73 65 44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 BaseDexClassLoader
condition:
((#a_03_0 & 1)*10+(#a_03_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=21
}
Adware/AndroidOS/Adlo/Adware_AndroidOS_Adlo_B_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_AndroidOS_Adlo_B_MTB{
meta:
description = "Adware:AndroidOS/Adlo.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {49 03 00 08 48 04 02 08 dd 04 04 1f b7 43 8e 33 50 03 00 08 d8 08 08 01 } //1
$a_03_1 = {12 40 23 00 ?? 00 12 01 4d 02 00 01 62 02 05 00 12 11 4d 02 00 01 12 02 12 21 4d 02 00 01 12 32 4d 03 00 02 } //1
condition:
((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2
rule Adware_AndroidOS_Adlo_B_MTB{
meta:
description = "Adware:AndroidOS/Adlo.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {49 03 00 08 48 04 02 08 dd 04 04 1f b7 43 8e 33 50 03 00 08 d8 08 08 01 } //1
$a_03_1 = {12 40 23 00 ?? 00 12 01 4d 02 00 01 62 02 05 00 12 11 4d 02 00 01 12 02 12 21 4d 02 00 01 12 32 4d 03 00 02 } //1
condition:
((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2
}
Adware/AndroidOS/Adlo/Adware_AndroidOS_Adlo_C_MTB.yar
+13
View File
@@ -0,0 +1,13 @@
rule Adware_AndroidOS_Adlo_C_MTB{
meta:
description = "Adware:AndroidOS/Adlo.C!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 03 00 00 "
strings :
$a_01_0 = {0c 02 6f 20 01 00 21 00 12 02 69 02 05 00 0e 00 03 00 01 00 02 } //1
$a_01_1 = {00 00 00 00 00 00 00 11 00 00 00 12 00 69 00 05 00 6f 10 02 00 02 00 0c 00 22 01 1a 00 70 10 19 00 01 00 } //1
$a_01_2 = {62 0b 02 00 4d 0b 0c 02 6e 30 13 00 a9 0c 0c 09 71 10 16 00 08 00 0c 08 23 00 34 00 4d 06 00 01 4d 08 00 02 12 08 6e 30 27 00 89 00 0c 00 35 71 0d 00 71 20 21 00 14 00 0c 09 71 30 23 00 10 09 b0 21 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=2
}
Adware/AndroidOS/Ashas/Adware_AndroidOS_Ashas_A.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_Ashas_A{
meta:
description = "Adware:AndroidOS/Ashas.A,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 05 00 00 "
strings :
$a_00_0 = {41 53 48 41 53 } //2 ASHAS
$a_00_1 = {43 4f 44 45 5f 43 4c 49 45 4e 54 5f 43 4f 4e 46 49 47 } //2 CODE_CLIENT_CONFIG
$a_00_2 = {41 4c 41 52 4d 5f 53 43 48 45 44 55 4c 45 5f 4d 49 4e 55 54 45 53 } //2 ALARM_SCHEDULE_MINUTES
$a_01_3 = {41 53 61 64 73 64 6b } //1 ASadsdk
$a_00_4 = {46 69 72 73 74 52 75 6e 53 65 72 76 69 63 65 20 6f 6e 43 72 65 61 74 65 } //1 FirstRunService onCreate
condition:
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_01_3 & 1)*1+(#a_00_4 & 1)*1) >=7
rule Adware_AndroidOS_Ashas_A{
meta:
description = "Adware:AndroidOS/Ashas.A,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 05 00 00 "
strings :
$a_00_0 = {41 53 48 41 53 } //2 ASHAS
$a_00_1 = {43 4f 44 45 5f 43 4c 49 45 4e 54 5f 43 4f 4e 46 49 47 } //2 CODE_CLIENT_CONFIG
$a_00_2 = {41 4c 41 52 4d 5f 53 43 48 45 44 55 4c 45 5f 4d 49 4e 55 54 45 53 } //2 ALARM_SCHEDULE_MINUTES
$a_01_3 = {41 53 61 64 73 64 6b } //1 ASadsdk
$a_00_4 = {46 69 72 73 74 52 75 6e 53 65 72 76 69 63 65 20 6f 6e 43 72 65 61 74 65 } //1 FirstRunService onCreate
condition:
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_01_3 & 1)*1+(#a_00_4 & 1)*1) >=7
}
Adware/AndroidOS/CallFlakes/Adware_AndroidOS_CallFlakes_A_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_CallFlakes_A_MTB{
meta:
description = "Adware:AndroidOS/CallFlakes.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_00_0 = {50 6f 73 74 43 61 6c 6c 4d 61 6e 61 67 65 72 53 44 4b } //1 PostCallManagerSDK
$a_00_1 = {6c 6f 61 64 41 64 42 61 6e 6e 65 72 53 74 61 72 74 41 70 70 } //1 loadAdBannerStartApp
$a_00_2 = {77 77 77 2e 66 72 65 65 61 70 70 73 6f 66 74 68 65 64 61 79 2e 63 6f 6d } //1 www.freeappsoftheday.com
$a_00_3 = {43 61 6c 6c 20 54 65 72 6d 69 6e 61 74 65 20 2d 20 41 64 20 62 61 6e 6e 65 72 } //1 Call Terminate - Ad banner
$a_00_4 = {43 61 6c 6c 20 54 65 72 6d 69 6e 61 74 65 20 2d 20 52 65 6d 6f 76 65 } //1 Call Terminate - Remove
$a_00_5 = {63 6c 69 63 6b 4c 69 73 74 65 6e 65 72 41 64 64 43 6f 6e 74 61 63 74 } //1 clickListenerAddContact
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=5
rule Adware_AndroidOS_CallFlakes_A_MTB{
meta:
description = "Adware:AndroidOS/CallFlakes.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_00_0 = {50 6f 73 74 43 61 6c 6c 4d 61 6e 61 67 65 72 53 44 4b } //1 PostCallManagerSDK
$a_00_1 = {6c 6f 61 64 41 64 42 61 6e 6e 65 72 53 74 61 72 74 41 70 70 } //1 loadAdBannerStartApp
$a_00_2 = {77 77 77 2e 66 72 65 65 61 70 70 73 6f 66 74 68 65 64 61 79 2e 63 6f 6d } //1 www.freeappsoftheday.com
$a_00_3 = {43 61 6c 6c 20 54 65 72 6d 69 6e 61 74 65 20 2d 20 41 64 20 62 61 6e 6e 65 72 } //1 Call Terminate - Ad banner
$a_00_4 = {43 61 6c 6c 20 54 65 72 6d 69 6e 61 74 65 20 2d 20 52 65 6d 6f 76 65 } //1 Call Terminate - Remove
$a_00_5 = {63 6c 69 63 6b 4c 69 73 74 65 6e 65 72 41 64 64 43 6f 6e 74 61 63 74 } //1 clickListenerAddContact
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=5
}
Adware/AndroidOS/CopyCatz/Adware_AndroidOS_CopyCatz_A_MTB.yar
+20 -20
View File
@@ -1,21 +1,21 @@
rule Adware_AndroidOS_CopyCatz_A_MTB{
meta:
description = "Adware:AndroidOS/CopyCatz.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,0e 00 0e 00 0b 00 00 "
strings :
$a_01_0 = {63 6f 6d 2e 74 64 63 2e 61 64 73 65 72 76 69 63 65 } //10 com.tdc.adservice
$a_01_1 = {63 6f 6d 2e 6e 65 6e 64 2e 61 64 73 65 72 76 69 63 65 } //10 com.nend.adservice
$a_01_2 = {63 6f 6d 2e 65 6c 69 73 65 2e 61 64 73 65 72 76 69 63 65 } //10 com.elise.adservice
$a_01_3 = {63 6f 6d 2e 56 70 6f 6e 2e 61 64 73 65 72 76 69 63 65 } //10 com.Vpon.adservice
$a_01_4 = {63 6f 6d 2e 56 75 6e 67 6c 65 2e 61 64 73 65 72 76 69 63 65 } //10 com.Vungle.adservice
$a_01_5 = {63 6f 6d 2e 75 6d 65 6e 67 2e 61 64 73 65 72 76 69 63 65 } //10 com.umeng.adservice
$a_01_6 = {63 6f 6d 2e 6d 61 69 6f 2e 61 64 73 65 72 76 69 63 65 } //10 com.maio.adservice
$a_01_7 = {66 75 6c 6c 41 64 49 64 } //1 fullAdId
$a_01_8 = {72 65 71 75 65 73 74 4e 65 77 49 6e 74 65 72 73 74 69 74 69 61 6c } //1 requestNewInterstitial
$a_01_9 = {41 64 73 4a 6f 62 } //1 AdsJob
$a_01_10 = {61 64 73 41 63 74 69 76 69 74 79 } //1 adsActivity
condition:
((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=14
rule Adware_AndroidOS_CopyCatz_A_MTB{
meta:
description = "Adware:AndroidOS/CopyCatz.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,0e 00 0e 00 0b 00 00 "
strings :
$a_01_0 = {63 6f 6d 2e 74 64 63 2e 61 64 73 65 72 76 69 63 65 } //10 com.tdc.adservice
$a_01_1 = {63 6f 6d 2e 6e 65 6e 64 2e 61 64 73 65 72 76 69 63 65 } //10 com.nend.adservice
$a_01_2 = {63 6f 6d 2e 65 6c 69 73 65 2e 61 64 73 65 72 76 69 63 65 } //10 com.elise.adservice
$a_01_3 = {63 6f 6d 2e 56 70 6f 6e 2e 61 64 73 65 72 76 69 63 65 } //10 com.Vpon.adservice
$a_01_4 = {63 6f 6d 2e 56 75 6e 67 6c 65 2e 61 64 73 65 72 76 69 63 65 } //10 com.Vungle.adservice
$a_01_5 = {63 6f 6d 2e 75 6d 65 6e 67 2e 61 64 73 65 72 76 69 63 65 } //10 com.umeng.adservice
$a_01_6 = {63 6f 6d 2e 6d 61 69 6f 2e 61 64 73 65 72 76 69 63 65 } //10 com.maio.adservice
$a_01_7 = {66 75 6c 6c 41 64 49 64 } //1 fullAdId
$a_01_8 = {72 65 71 75 65 73 74 4e 65 77 49 6e 74 65 72 73 74 69 74 69 61 6c } //1 requestNewInterstitial
$a_01_9 = {41 64 73 4a 6f 62 } //1 AdsJob
$a_01_10 = {61 64 73 41 63 74 69 76 69 74 79 } //1 adsActivity
condition:
((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=14
}
Adware/AndroidOS/Dasu/Adware_AndroidOS_Dasu_A_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_Dasu_A_MTB{
meta:
description = "Adware:AndroidOS/Dasu.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_03_0 = {10 00 54 31 [0-10] 21 00 22 00 [0-06] 00 00 1a 01 [0-06] 10 00 54 31 [0-10] 21 00 22 00 [0-06] 00 00 22 00 [0-06] 00 00 1a 01 [0-06] 10 00 54 31 } //1
$a_01_1 = {54 78 77 70 33 50 49 66 59 5a 42 71 58 2f 45 52 51 6b 64 35 78 42 78 46 30 58 51 } //1 Txwp3PIfYZBqX/ERQkd5xBxF0XQ
$a_01_2 = {63 6f 6d 2f 6c 6f 61 64 65 72 2f 61 63 74 69 76 69 74 79 2f 50 41 } //1 com/loader/activity/PA
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_4 = {67 65 74 52 75 6e 6e 69 6e 67 54 61 73 6b 73 } //1 getRunningTasks
$a_01_5 = {73 65 74 41 75 74 6f 43 61 6e 63 65 6c } //1 setAutoCancel
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
rule Adware_AndroidOS_Dasu_A_MTB{
meta:
description = "Adware:AndroidOS/Dasu.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_03_0 = {10 00 54 31 [0-10] 21 00 22 00 [0-06] 00 00 1a 01 [0-06] 10 00 54 31 [0-10] 21 00 22 00 [0-06] 00 00 22 00 [0-06] 00 00 1a 01 [0-06] 10 00 54 31 } //1
$a_01_1 = {54 78 77 70 33 50 49 66 59 5a 42 71 58 2f 45 52 51 6b 64 35 78 42 78 46 30 58 51 } //1 Txwp3PIfYZBqX/ERQkd5xBxF0XQ
$a_01_2 = {63 6f 6d 2f 6c 6f 61 64 65 72 2f 61 63 74 69 76 69 74 79 2f 50 41 } //1 com/loader/activity/PA
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_4 = {67 65 74 52 75 6e 6e 69 6e 67 54 61 73 6b 73 } //1 getRunningTasks
$a_01_5 = {73 65 74 41 75 74 6f 43 61 6e 63 65 6c } //1 setAutoCancel
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
Adware/AndroidOS/Dnotua/Adware_AndroidOS_Dnotua_A_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_Dnotua_A_MTB{
meta:
description = "Adware:AndroidOS/Dnotua.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 77 65 62 68 35 2f 63 6f 64 65 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //1 com/webh5/code/MainActivity
$a_01_1 = {2f 55 72 6c 4f 70 65 6e 54 6f 6f 6c } //1 /UrlOpenTool
$a_01_2 = {73 65 74 4a 61 76 61 53 63 72 69 70 74 45 6e 61 62 6c 65 64 } //1 setJavaScriptEnabled
$a_01_3 = {73 65 74 44 6f 6d 53 74 6f 72 61 67 65 45 6e 61 62 6c 65 64 } //1 setDomStorageEnabled
$a_01_4 = {73 68 6f 75 6c 64 4f 76 65 72 72 69 64 65 55 72 6c 4c 6f 61 64 69 6e 67 } //1 shouldOverrideUrlLoading
$a_01_5 = {63 61 6e 47 6f 42 61 63 6b } //1 canGoBack
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
rule Adware_AndroidOS_Dnotua_A_MTB{
meta:
description = "Adware:AndroidOS/Dnotua.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 77 65 62 68 35 2f 63 6f 64 65 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //1 com/webh5/code/MainActivity
$a_01_1 = {2f 55 72 6c 4f 70 65 6e 54 6f 6f 6c } //1 /UrlOpenTool
$a_01_2 = {73 65 74 4a 61 76 61 53 63 72 69 70 74 45 6e 61 62 6c 65 64 } //1 setJavaScriptEnabled
$a_01_3 = {73 65 74 44 6f 6d 53 74 6f 72 61 67 65 45 6e 61 62 6c 65 64 } //1 setDomStorageEnabled
$a_01_4 = {73 68 6f 75 6c 64 4f 76 65 72 72 69 64 65 55 72 6c 4c 6f 61 64 69 6e 67 } //1 shouldOverrideUrlLoading
$a_01_5 = {63 61 6e 47 6f 42 61 63 6b } //1 canGoBack
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
Adware/AndroidOS/Dowgin/Adware_AndroidOS_Dowgin_A_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_AndroidOS_Dowgin_A_MTB{
meta:
description = "Adware:AndroidOS/Dowgin.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_03_0 = {38 00 31 00 62 00 ?? ?? 13 01 0d 00 71 10 ?? ?? 01 00 0c 01 6e 20 ?? ?? 10 00 62 00 } //1
$a_01_1 = {6f 6e 53 74 61 72 74 43 6f 6d 6d 61 6e 64 } //1 onStartCommand
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2
rule Adware_AndroidOS_Dowgin_A_MTB{
meta:
description = "Adware:AndroidOS/Dowgin.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_03_0 = {38 00 31 00 62 00 ?? ?? 13 01 0d 00 71 10 ?? ?? 01 00 0c 01 6e 20 ?? ?? 10 00 62 00 } //1
$a_01_1 = {6f 6e 53 74 61 72 74 43 6f 6d 6d 61 6e 64 } //1 onStartCommand
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Adware/AndroidOS/Ewind/Adware_AndroidOS_Ewind_A.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_Ewind_A{
meta:
description = "Adware:AndroidOS/Ewind.A,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {48 65 79 48 65 79 } //1 HeyHey
$a_01_1 = {41 6c 69 76 65 45 76 65 6e 74 53 65 6e 64 41 6c 61 72 6d } //1 AliveEventSendAlarm
$a_01_2 = {43 72 79 6f 70 69 67 67 79 41 70 70 6c 69 63 61 74 69 6f 6e } //1 CryopiggyApplication
$a_01_3 = {69 73 49 6d 70 72 65 73 73 69 6f 6e 57 61 73 44 6f 6e 65 } //1 isImpressionWasDone
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_Ewind_A{
meta:
description = "Adware:AndroidOS/Ewind.A,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {48 65 79 48 65 79 } //1 HeyHey
$a_01_1 = {41 6c 69 76 65 45 76 65 6e 74 53 65 6e 64 41 6c 61 72 6d } //1 AliveEventSendAlarm
$a_01_2 = {43 72 79 6f 70 69 67 67 79 41 70 70 6c 69 63 61 74 69 6f 6e } //1 CryopiggyApplication
$a_01_3 = {69 73 49 6d 70 72 65 73 73 69 6f 6e 57 61 73 44 6f 6e 65 } //1 isImpressionWasDone
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/Ewind/Adware_AndroidOS_Ewind_B.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_Ewind_B{
meta:
description = "Adware:AndroidOS/Ewind.B,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {6d 61 6e 61 67 65 72 2f 6c 6f 63 6b 73 63 72 65 65 6e 2f 4c 6f 63 6b 73 63 72 65 65 6e 4d 61 6e 61 67 65 72 49 6d 70 6c } //1 manager/lockscreen/LockscreenManagerImpl
$a_01_1 = {73 74 61 72 74 53 63 72 65 65 6e 52 65 63 65 69 76 65 72 } //1 startScreenReceiver
$a_01_2 = {75 6e 6c 6f 63 6b 41 64 44 65 74 65 63 74 6f 72 } //1 unlockAdDetector
$a_01_3 = {73 64 6b 2f 73 65 72 76 69 63 65 2f 64 65 74 65 63 74 6f 72 2f 44 65 74 65 63 74 6f 72 } //1 sdk/service/detector/Detector
$a_01_4 = {73 68 6f 77 4c 6f 63 6b 73 63 72 65 65 6e 41 64 54 61 73 6b 46 61 63 74 6f 72 79 } //1 showLockscreenAdTaskFactory
$a_01_5 = {43 72 79 6f 70 69 67 67 79 41 70 70 6c 69 63 61 74 69 6f 6e } //1 CryopiggyApplication
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
rule Adware_AndroidOS_Ewind_B{
meta:
description = "Adware:AndroidOS/Ewind.B,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {6d 61 6e 61 67 65 72 2f 6c 6f 63 6b 73 63 72 65 65 6e 2f 4c 6f 63 6b 73 63 72 65 65 6e 4d 61 6e 61 67 65 72 49 6d 70 6c } //1 manager/lockscreen/LockscreenManagerImpl
$a_01_1 = {73 74 61 72 74 53 63 72 65 65 6e 52 65 63 65 69 76 65 72 } //1 startScreenReceiver
$a_01_2 = {75 6e 6c 6f 63 6b 41 64 44 65 74 65 63 74 6f 72 } //1 unlockAdDetector
$a_01_3 = {73 64 6b 2f 73 65 72 76 69 63 65 2f 64 65 74 65 63 74 6f 72 2f 44 65 74 65 63 74 6f 72 } //1 sdk/service/detector/Detector
$a_01_4 = {73 68 6f 77 4c 6f 63 6b 73 63 72 65 65 6e 41 64 54 61 73 6b 46 61 63 74 6f 72 79 } //1 showLockscreenAdTaskFactory
$a_01_5 = {43 72 79 6f 70 69 67 67 79 41 70 70 6c 69 63 61 74 69 6f 6e } //1 CryopiggyApplication
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
Adware/AndroidOS/Feiad/Adware_AndroidOS_Feiad_A_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_Feiad_A_MTB{
meta:
description = "Adware:AndroidOS/Feiad.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 61 64 66 65 69 77 6f 2f } //1 com/adfeiwo/
$a_01_1 = {73 68 6f 77 41 64 } //1 showAd
$a_01_2 = {2f 61 64 66 65 69 77 6f 2f 61 70 70 77 61 6c 6c 2f 61 70 6b } //1 /adfeiwo/appwall/apk
$a_01_3 = {63 6f 6d 2f 73 65 6c 65 75 63 6f 2f 6d 61 6d 65 34 61 6c 6c } //1 com/seleuco/mame4all
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_Feiad_A_MTB{
meta:
description = "Adware:AndroidOS/Feiad.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 61 64 66 65 69 77 6f 2f } //1 com/adfeiwo/
$a_01_1 = {73 68 6f 77 41 64 } //1 showAd
$a_01_2 = {2f 61 64 66 65 69 77 6f 2f 61 70 70 77 61 6c 6c 2f 61 70 6b } //1 /adfeiwo/appwall/apk
$a_01_3 = {63 6f 6d 2f 73 65 6c 65 75 63 6f 2f 6d 61 6d 65 34 61 6c 6c } //1 com/seleuco/mame4all
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/Fictus/Adware_AndroidOS_Fictus_A_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_Fictus_A_MTB{
meta:
description = "Adware:AndroidOS/Fictus.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {61 70 6b 66 69 6c 65 73 2e 63 6f 6d 2f 61 70 6b 2d 32 34 38 35 32 2f 61 72 2d 63 6c 65 61 6e 65 72 2f } //1 apkfiles.com/apk-24852/ar-cleaner/
$a_01_1 = {63 6f 6d 2f 61 70 70 2f 61 74 74 61 63 6b 65 72 2f 67 6f 6f 64 77 6f 72 6b } //1 com/app/attacker/goodwork
$a_01_2 = {6d 6f 62 69 6c 65 61 64 73 } //1 mobileads
$a_01_3 = {41 64 44 69 73 70 6c 61 79 4c 69 73 74 65 6e 65 72 } //1 AdDisplayListener
$a_01_4 = {6c 6f 61 64 41 64 73 } //1 loadAds
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_AndroidOS_Fictus_A_MTB{
meta:
description = "Adware:AndroidOS/Fictus.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {61 70 6b 66 69 6c 65 73 2e 63 6f 6d 2f 61 70 6b 2d 32 34 38 35 32 2f 61 72 2d 63 6c 65 61 6e 65 72 2f } //1 apkfiles.com/apk-24852/ar-cleaner/
$a_01_1 = {63 6f 6d 2f 61 70 70 2f 61 74 74 61 63 6b 65 72 2f 67 6f 6f 64 77 6f 72 6b } //1 com/app/attacker/goodwork
$a_01_2 = {6d 6f 62 69 6c 65 61 64 73 } //1 mobileads
$a_01_3 = {41 64 44 69 73 70 6c 61 79 4c 69 73 74 65 6e 65 72 } //1 AdDisplayListener
$a_01_4 = {6c 6f 61 64 41 64 73 } //1 loadAds
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/AndroidOS/Fictus/Adware_AndroidOS_Fictus_B_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_Fictus_B_MTB{
meta:
description = "Adware:AndroidOS/Fictus.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 72 69 78 61 6c 6c 61 62 2f 61 64 73 2f 61 64 73 } //1 com/rixallab/ads/ads
$a_01_1 = {61 64 73 30 31 2e 61 64 65 63 6f 73 79 73 74 65 6d 73 2e 63 6f 6d } //1 ads01.adecosystems.com
$a_01_2 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_3 = {70 72 65 6c 6f 61 64 41 64 } //1 preloadAd
$a_01_4 = {63 6f 6d 2f 76 64 6f 70 69 61 2f 61 6e 64 72 6f 69 64 2f 70 72 65 72 6f 6c 6c } //1 com/vdopia/android/preroll
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_AndroidOS_Fictus_B_MTB{
meta:
description = "Adware:AndroidOS/Fictus.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 72 69 78 61 6c 6c 61 62 2f 61 64 73 2f 61 64 73 } //1 com/rixallab/ads/ads
$a_01_1 = {61 64 73 30 31 2e 61 64 65 63 6f 73 79 73 74 65 6d 73 2e 63 6f 6d } //1 ads01.adecosystems.com
$a_01_2 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_3 = {70 72 65 6c 6f 61 64 41 64 } //1 preloadAd
$a_01_4 = {63 6f 6d 2f 76 64 6f 70 69 61 2f 61 6e 64 72 6f 69 64 2f 70 72 65 72 6f 6c 6c } //1 com/vdopia/android/preroll
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/AndroidOS/Flurry99/Adware_AndroidOS_Flurry99_A.yar
+17 -17
View File
@@ -1,18 +1,18 @@
rule Adware_AndroidOS_Flurry99_A{
meta:
description = "Adware:AndroidOS/Flurry99.A,SIGNATURE_TYPE_ELFHSTR_EXT,1f 00 1f 00 08 00 00 "
strings :
$a_01_0 = {4a 61 76 61 5f 63 6f 6d 5f 66 6c 75 72 72 79 5f 73 64 6b 5f 6e 61 5f 53 6f 67 74 } //16 Java_com_flurry_sdk_na_Sogt
$a_01_1 = {77 64 6d 6e 67 70 72 } //3 wdmngpr
$a_01_2 = {76 67 72 6c 61 79 70 72 } //3 vgrlaypr
$a_01_3 = {61 76 6d 74 65 76 } //3 avmtev
$a_01_4 = {61 6c 72 6d 70 61 74 68 } //3 alrmpath
$a_01_5 = {41 45 53 5f 43 42 43 5f 64 65 63 72 79 70 74 } //1 AES_CBC_decrypt
$a_01_6 = {41 45 53 5f 43 42 43 5f 65 6e 63 72 79 70 74 } //1 AES_CBC_encrypt
$a_01_7 = {62 36 34 5f 64 65 63 6f 64 65 } //1 b64_decode
condition:
((#a_01_0 & 1)*16+(#a_01_1 & 1)*3+(#a_01_2 & 1)*3+(#a_01_3 & 1)*3+(#a_01_4 & 1)*3+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=31
rule Adware_AndroidOS_Flurry99_A{
meta:
description = "Adware:AndroidOS/Flurry99.A,SIGNATURE_TYPE_ELFHSTR_EXT,1f 00 1f 00 08 00 00 "
strings :
$a_01_0 = {4a 61 76 61 5f 63 6f 6d 5f 66 6c 75 72 72 79 5f 73 64 6b 5f 6e 61 5f 53 6f 67 74 } //16 Java_com_flurry_sdk_na_Sogt
$a_01_1 = {77 64 6d 6e 67 70 72 } //3 wdmngpr
$a_01_2 = {76 67 72 6c 61 79 70 72 } //3 vgrlaypr
$a_01_3 = {61 76 6d 74 65 76 } //3 avmtev
$a_01_4 = {61 6c 72 6d 70 61 74 68 } //3 alrmpath
$a_01_5 = {41 45 53 5f 43 42 43 5f 64 65 63 72 79 70 74 } //1 AES_CBC_decrypt
$a_01_6 = {41 45 53 5f 43 42 43 5f 65 6e 63 72 79 70 74 } //1 AES_CBC_encrypt
$a_01_7 = {62 36 34 5f 64 65 63 6f 64 65 } //1 b64_decode
condition:
((#a_01_0 & 1)*16+(#a_01_1 & 1)*3+(#a_01_2 & 1)*3+(#a_01_3 & 1)*3+(#a_01_4 & 1)*3+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=31
}
Adware/AndroidOS/Hiddad/Adware_AndroidOS_Hiddad_B_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_Hiddad_B_MTB{
meta:
description = "Adware:AndroidOS/Hiddad.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_01_0 = {2f 63 6c 69 65 6e 74 2e 63 6f 6e 66 69 67 2f 3f 61 70 70 3d 70 6e 64 72 32 26 66 6f 72 6d 61 74 3d 6a 73 6f 6e 26 61 64 76 65 72 74 5f 6b 65 79 3d } //1 /client.config/?app=pndr2&format=json&advert_key=
$a_01_1 = {26 70 6e 64 72 5f 69 6e 73 74 61 6c 6c 3d 31 } //1 &pndr_install=1
$a_01_2 = {6c 6f 63 6b 5f 65 6e 61 62 6c 65 5f 61 64 } //1 lock_enable_ad
$a_01_3 = {49 4e 54 45 4e 54 5f 41 44 5f 53 48 4f 57 } //1 INTENT_AD_SHOW
$a_01_4 = {6f 6e 41 64 43 6c 69 63 6b 65 64 } //1 onAdClicked
$a_01_5 = {61 70 69 2e 6a 65 74 65 6e 67 69 6e 65 2e 62 65 } //1 api.jetengine.be
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
rule Adware_AndroidOS_Hiddad_B_MTB{
meta:
description = "Adware:AndroidOS/Hiddad.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_01_0 = {2f 63 6c 69 65 6e 74 2e 63 6f 6e 66 69 67 2f 3f 61 70 70 3d 70 6e 64 72 32 26 66 6f 72 6d 61 74 3d 6a 73 6f 6e 26 61 64 76 65 72 74 5f 6b 65 79 3d } //1 /client.config/?app=pndr2&format=json&advert_key=
$a_01_1 = {26 70 6e 64 72 5f 69 6e 73 74 61 6c 6c 3d 31 } //1 &pndr_install=1
$a_01_2 = {6c 6f 63 6b 5f 65 6e 61 62 6c 65 5f 61 64 } //1 lock_enable_ad
$a_01_3 = {49 4e 54 45 4e 54 5f 41 44 5f 53 48 4f 57 } //1 INTENT_AD_SHOW
$a_01_4 = {6f 6e 41 64 43 6c 69 63 6b 65 64 } //1 onAdClicked
$a_01_5 = {61 70 69 2e 6a 65 74 65 6e 67 69 6e 65 2e 62 65 } //1 api.jetengine.be
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
}
Adware/AndroidOS/Hiddad/Adware_AndroidOS_Hiddad_C_MTB.yar
+16 -16
View File
@@ -1,17 +1,17 @@
rule Adware_AndroidOS_Hiddad_C_MTB{
meta:
description = "Adware:AndroidOS/Hiddad.C!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {73 65 74 41 64 4c 6f 61 64 4c 69 73 74 65 6e 65 72 } //1 setAdLoadListener
$a_01_1 = {6f 6e 41 64 43 6c 69 63 6b 65 64 } //1 onAdClicked
$a_01_2 = {4c 6f 61 64 41 70 70 6c 6f 76 69 6e 46 75 6c 6c 41 64 73 } //1 LoadApplovinFullAds
$a_01_3 = {61 64 48 69 64 64 65 6e } //1 adHidden
$a_01_4 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_5 = {4c 6f 61 64 42 61 6e 6e 65 72 46 62 76 69 65 77 } //1 LoadBannerFbview
$a_01_6 = {73 65 74 43 6f 6d 70 6f 6e 65 6e 74 45 6e 61 62 6c 65 64 53 65 74 74 69 6e 67 } //1 setComponentEnabledSetting
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
rule Adware_AndroidOS_Hiddad_C_MTB{
meta:
description = "Adware:AndroidOS/Hiddad.C!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {73 65 74 41 64 4c 6f 61 64 4c 69 73 74 65 6e 65 72 } //1 setAdLoadListener
$a_01_1 = {6f 6e 41 64 43 6c 69 63 6b 65 64 } //1 onAdClicked
$a_01_2 = {4c 6f 61 64 41 70 70 6c 6f 76 69 6e 46 75 6c 6c 41 64 73 } //1 LoadApplovinFullAds
$a_01_3 = {61 64 48 69 64 64 65 6e } //1 adHidden
$a_01_4 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_5 = {4c 6f 61 64 42 61 6e 6e 65 72 46 62 76 69 65 77 } //1 LoadBannerFbview
$a_01_6 = {73 65 74 43 6f 6d 70 6f 6e 65 6e 74 45 6e 61 62 6c 65 64 53 65 74 74 69 6e 67 } //1 setComponentEnabledSetting
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
Adware/AndroidOS/Hiddad/Adware_AndroidOS_Hiddad_D_MTB.yar
+12 -12
View File
@@ -1,13 +1,13 @@
rule Adware_AndroidOS_Hiddad_D_MTB{
meta:
description = "Adware:AndroidOS/Hiddad.D!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {2f 54 68 65 4a 6f 62 43 68 72 6f 6d 69 75 6d } //2 /TheJobChromium
$a_01_1 = {2f 54 68 65 4a 6f 62 53 69 6e 67 6c 65 74 6f 6e } //1 /TheJobSingleton
$a_01_2 = {73 74 61 72 74 54 68 65 42 72 6f 77 73 65 72 } //1 startTheBrowser
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
rule Adware_AndroidOS_Hiddad_D_MTB{
meta:
description = "Adware:AndroidOS/Hiddad.D!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {2f 54 68 65 4a 6f 62 43 68 72 6f 6d 69 75 6d } //2 /TheJobChromium
$a_01_1 = {2f 54 68 65 4a 6f 62 53 69 6e 67 6c 65 74 6f 6e } //1 /TheJobSingleton
$a_01_2 = {73 74 61 72 74 54 68 65 42 72 6f 77 73 65 72 } //1 startTheBrowser
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Adware/AndroidOS/Hiddad/Adware_AndroidOS_Hiddad_E_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_Hiddad_E_MTB{
meta:
description = "Adware:AndroidOS/Hiddad.E!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {2f 72 65 67 69 73 74 65 72 5f 61 64 73 2e 70 68 70 } //2 /register_ads.php
$a_01_1 = {6f 6e 41 64 4c 6f 61 64 65 64 } //1 onAdLoaded
$a_01_2 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 4c 69 73 74 65 6e 65 72 } //1 InterstitialAdListener
$a_01_3 = {6f 6e 41 64 43 6c 69 63 6b 65 64 } //1 onAdClicked
$a_01_4 = {72 65 67 69 73 74 65 72 41 64 73 28 29 2e 65 78 65 63 75 74 65 28 29 } //1 registerAds().execute()
$a_01_5 = {6f 6e 4d 65 64 69 61 44 6f 77 6e 6c 6f 61 64 65 64 } //1 onMediaDownloaded
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
rule Adware_AndroidOS_Hiddad_E_MTB{
meta:
description = "Adware:AndroidOS/Hiddad.E!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {2f 72 65 67 69 73 74 65 72 5f 61 64 73 2e 70 68 70 } //2 /register_ads.php
$a_01_1 = {6f 6e 41 64 4c 6f 61 64 65 64 } //1 onAdLoaded
$a_01_2 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 4c 69 73 74 65 6e 65 72 } //1 InterstitialAdListener
$a_01_3 = {6f 6e 41 64 43 6c 69 63 6b 65 64 } //1 onAdClicked
$a_01_4 = {72 65 67 69 73 74 65 72 41 64 73 28 29 2e 65 78 65 63 75 74 65 28 29 } //1 registerAds().execute()
$a_01_5 = {6f 6e 4d 65 64 69 61 44 6f 77 6e 6c 6f 61 64 65 64 } //1 onMediaDownloaded
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
Adware/AndroidOS/IconHider/Adware_AndroidOS_IconHider_A_MTB.yar
+12 -12
View File
@@ -1,13 +1,13 @@
rule Adware_AndroidOS_IconHider_A_MTB{
meta:
description = "Adware:AndroidOS/IconHider.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {6d 61 70 69 2e 31 6f 63 65 61 6e 73 2e 63 6f 6d } //1 mapi.1oceans.com
$a_01_1 = {67 65 74 43 6c 69 63 6b 53 70 } //1 getClickSp
$a_01_2 = {63 6c 69 63 6b 44 65 6c 61 79 54 69 6d 65 } //1 clickDelayTime
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
rule Adware_AndroidOS_IconHider_A_MTB{
meta:
description = "Adware:AndroidOS/IconHider.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {6d 61 70 69 2e 31 6f 63 65 61 6e 73 2e 63 6f 6d } //1 mapi.1oceans.com
$a_01_1 = {67 65 74 43 6c 69 63 6b 53 70 } //1 getClickSp
$a_01_2 = {63 6c 69 63 6b 44 65 6c 61 79 54 69 6d 65 } //1 clickDelayTime
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Adware/AndroidOS/Mobby/Adware_AndroidOS_Mobby_A_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_Mobby_A_MTB{
meta:
description = "Adware:AndroidOS/Mobby.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 05 00 00 "
strings :
$a_00_0 = {69 6f 2f 6d 6f 62 62 79 2f 6c 6f 61 64 65 72 2f 61 70 } //1 io/mobby/loader/ap
$a_01_1 = {43 72 79 6f 6c 6f 61 64 65 72 } //2 Cryoloader
$a_01_2 = {67 65 74 53 65 72 76 65 72 } //1 getServer
$a_01_3 = {72 65 76 6f 6c 75 6d 62 75 73 2e 73 70 61 63 65 } //2 revolumbus.space
$a_01_4 = {73 74 61 72 74 53 65 72 76 69 63 65 } //1 startService
condition:
((#a_00_0 & 1)*1+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1) >=6
rule Adware_AndroidOS_Mobby_A_MTB{
meta:
description = "Adware:AndroidOS/Mobby.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 05 00 00 "
strings :
$a_00_0 = {69 6f 2f 6d 6f 62 62 79 2f 6c 6f 61 64 65 72 2f 61 70 } //1 io/mobby/loader/ap
$a_01_1 = {43 72 79 6f 6c 6f 61 64 65 72 } //2 Cryoloader
$a_01_2 = {67 65 74 53 65 72 76 65 72 } //1 getServer
$a_01_3 = {72 65 76 6f 6c 75 6d 62 75 73 2e 73 70 61 63 65 } //2 revolumbus.space
$a_01_4 = {73 74 61 72 74 53 65 72 76 69 63 65 } //1 startService
condition:
((#a_00_0 & 1)*1+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1) >=6
}
Adware/AndroidOS/Mobhey/Adware_AndroidOS_Mobhey_A_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_Mobhey_A_MTB{
meta:
description = "Adware:AndroidOS/Mobhey.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {61 64 2e 6d 61 69 6c 2e 72 75 2f 6d 6f 62 69 6c 65 2f } //1 ad.mail.ru/mobile/
$a_01_1 = {63 6f 6d 2f 63 6f 6f 74 65 6b 2f 69 63 6f 6e 66 61 63 65 } //1 com/cootek/iconface
$a_01_2 = {63 6f 6d 2f 6d 79 2f 74 61 72 67 65 74 2f 61 64 73 2f 4d 79 54 61 72 67 65 74 41 63 74 69 76 69 74 79 } //1 com/my/target/ads/MyTargetActivity
$a_01_3 = {54 72 61 63 65 72 41 63 74 69 76 69 74 79 4c 69 66 65 63 79 63 6c 65 43 61 6c 6c 62 61 63 6b } //1 TracerActivityLifecycleCallback
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_Mobhey_A_MTB{
meta:
description = "Adware:AndroidOS/Mobhey.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {61 64 2e 6d 61 69 6c 2e 72 75 2f 6d 6f 62 69 6c 65 2f } //1 ad.mail.ru/mobile/
$a_01_1 = {63 6f 6d 2f 63 6f 6f 74 65 6b 2f 69 63 6f 6e 66 61 63 65 } //1 com/cootek/iconface
$a_01_2 = {63 6f 6d 2f 6d 79 2f 74 61 72 67 65 74 2f 61 64 73 2f 4d 79 54 61 72 67 65 74 41 63 74 69 76 69 74 79 } //1 com/my/target/ads/MyTargetActivity
$a_01_3 = {54 72 61 63 65 72 41 63 74 69 76 69 74 79 4c 69 66 65 63 79 63 6c 65 43 61 6c 6c 62 61 63 6b } //1 TracerActivityLifecycleCallback
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_AA_MTB.yar
+10 -10
View File
@@ -1,11 +1,11 @@
rule Adware_AndroidOS_MobiDash_AA_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.AA!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_00_0 = {30 4a 30 4b 20 1c 31 1c 7a 44 7b 44 ff f7 07 fd 04 90 20 1c ff f7 2c fd 00 28 d6 d1 2b 4a 2b 4b 20 1c 31 1c 7a 44 7b 44 ff f7 f9 fc 05 90 20 1c ff f7 1e fd 00 28 } //1
condition:
((#a_00_0 & 1)*1) >=1
rule Adware_AndroidOS_MobiDash_AA_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.AA!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_00_0 = {30 4a 30 4b 20 1c 31 1c 7a 44 7b 44 ff f7 07 fd 04 90 20 1c ff f7 2c fd 00 28 d6 d1 2b 4a 2b 4b 20 1c 31 1c 7a 44 7b 44 ff f7 f9 fc 05 90 20 1c ff f7 1e fd 00 28 } //1
condition:
((#a_00_0 & 1)*1) >=1
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_AD_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_MobiDash_AD_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.AD!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 70 72 6f 70 75 62 6c 69 63 61 } //1 com/propublica
$a_01_1 = {70 72 6f 70 75 62 6c 69 63 61 2e 64 62 } //1 propublica.db
$a_01_2 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_MobiDash_AD_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.AD!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 70 72 6f 70 75 62 6c 69 63 61 } //1 com/propublica
$a_01_1 = {70 72 6f 70 75 62 6c 69 63 61 2e 64 62 } //1 propublica.db
$a_01_2 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_A_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_MobiDash_A_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 05 00 00 "
strings :
$a_01_0 = {60 00 98 00 6f 20 ec 09 98 00 6e 10 91 0f 08 00 52 81 dc 01 b7 91 59 89 dc 01 dd 02 09 04 12 03 12 14 39 02 04 00 12 12 28 02 } //3
$a_01_1 = {63 34 30 30 66 31 32 38 65 38 64 30 33 35 30 32 38 39 37 65 38 62 36 61 63 31 64 37 36 39 35 30 2e 63 6f 6d 2f } //3 c400f128e8d03502897e8b6ac1d76950.com/
$a_03_2 = {6e 65 74 2f [0-20] 4d 61 69 6e 41 63 74 69 76 69 74 79 24 61 } //1
$a_01_3 = {50 72 65 6c 6f 61 64 49 6e 66 6f } //1 PreloadInfo
$a_01_4 = {4c 6f 63 6b 73 63 72 65 65 6e } //1 Lockscreen
condition:
((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=8
rule Adware_AndroidOS_MobiDash_A_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 05 00 00 "
strings :
$a_01_0 = {60 00 98 00 6f 20 ec 09 98 00 6e 10 91 0f 08 00 52 81 dc 01 b7 91 59 89 dc 01 dd 02 09 04 12 03 12 14 39 02 04 00 12 12 28 02 } //3
$a_01_1 = {63 34 30 30 66 31 32 38 65 38 64 30 33 35 30 32 38 39 37 65 38 62 36 61 63 31 64 37 36 39 35 30 2e 63 6f 6d 2f } //3 c400f128e8d03502897e8b6ac1d76950.com/
$a_03_2 = {6e 65 74 2f [0-20] 4d 61 69 6e 41 63 74 69 76 69 74 79 24 61 } //1
$a_01_3 = {50 72 65 6c 6f 61 64 49 6e 66 6f } //1 PreloadInfo
$a_01_4 = {4c 6f 63 6b 73 63 72 65 65 6e } //1 Lockscreen
condition:
((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=8
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_B_MTB.yar
+16 -16
View File
@@ -1,17 +1,17 @@
rule Adware_AndroidOS_MobiDash_B_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_03_0 = {70 10 bb d6 01 00 12 00 5b 10 ?? ?? 12 00 5c 10 ?? ?? 0e 00 06 00 02 00 04 00 03 00 ?? ?? 4a 00 46 00 00 00 22 00 ?? ?? 12 01 70 30 } //1
$a_03_1 = {63 6f 6d 2f 6d 63 73 6b 69 6e 32 31 2f 44 72 65 61 6d 2f [0-20] 6f 6e 43 72 65 61 74 65 } //1
$a_01_2 = {63 6f 6d 2f 6d 63 73 6b 69 6e 32 31 2f 44 72 65 61 6d 2f 53 70 6c 61 73 68 41 63 74 69 76 69 74 79 } //1 com/mcskin21/Dream/SplashActivity
$a_01_3 = {73 65 74 41 64 4c 69 73 74 65 6e 65 72 } //1 setAdListener
$a_01_4 = {6d 49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 mInterstitialAd
$a_01_5 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_6 = {4d 6f 62 69 6c 65 41 64 73 2e 69 6e 69 74 69 61 6c 69 7a 65 } //1 MobileAds.initialize
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
rule Adware_AndroidOS_MobiDash_B_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_03_0 = {70 10 bb d6 01 00 12 00 5b 10 ?? ?? 12 00 5c 10 ?? ?? 0e 00 06 00 02 00 04 00 03 00 ?? ?? 4a 00 46 00 00 00 22 00 ?? ?? 12 01 70 30 } //1
$a_03_1 = {63 6f 6d 2f 6d 63 73 6b 69 6e 32 31 2f 44 72 65 61 6d 2f [0-20] 6f 6e 43 72 65 61 74 65 } //1
$a_01_2 = {63 6f 6d 2f 6d 63 73 6b 69 6e 32 31 2f 44 72 65 61 6d 2f 53 70 6c 61 73 68 41 63 74 69 76 69 74 79 } //1 com/mcskin21/Dream/SplashActivity
$a_01_3 = {73 65 74 41 64 4c 69 73 74 65 6e 65 72 } //1 setAdListener
$a_01_4 = {6d 49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 mInterstitialAd
$a_01_5 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_6 = {4d 6f 62 69 6c 65 41 64 73 2e 69 6e 69 74 69 61 6c 69 7a 65 } //1 MobileAds.initialize
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_C_MTB.yar
+16 -16
View File
@@ -1,17 +1,17 @@
rule Adware_AndroidOS_MobiDash_C_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.C!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_03_0 = {38 02 1c 00 71 00 ?? ?? 00 00 71 00 ?? ?? 00 00 12 02 67 02 ?? ?? 22 02 93 00 1c 03 ?? ?? 70 30 16 03 42 03 6e 20 ?? ?? 24 00 6e 10 ?? ?? 04 00 71 00 ?? ?? 00 00 0e 00 22 01 95 07 } //1
$a_01_1 = {63 6f 6d 2f 6e 75 70 75 69 74 2f 70 6d 70 31 2f 61 63 74 69 76 69 74 79 } //1 com/nupuit/pmp1/activity
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {35 39 33 30 65 64 61 38 63 66 61 35 61 62 33 39 30 38 30 30 31 35 34 30 } //1 5930eda8cfa5ab3908001540
$a_01_4 = {6d 49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 mInterstitialAd
$a_01_5 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_03_6 = {63 6f 6d 2f 6e 75 70 75 69 74 2f [0-20] 61 63 74 69 76 69 74 79 2f 4d 6f 63 6b 75 70 41 63 74 69 76 69 74 79 } //1
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_03_6 & 1)*1) >=7
rule Adware_AndroidOS_MobiDash_C_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.C!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_03_0 = {38 02 1c 00 71 00 ?? ?? 00 00 71 00 ?? ?? 00 00 12 02 67 02 ?? ?? 22 02 93 00 1c 03 ?? ?? 70 30 16 03 42 03 6e 20 ?? ?? 24 00 6e 10 ?? ?? 04 00 71 00 ?? ?? 00 00 0e 00 22 01 95 07 } //1
$a_01_1 = {63 6f 6d 2f 6e 75 70 75 69 74 2f 70 6d 70 31 2f 61 63 74 69 76 69 74 79 } //1 com/nupuit/pmp1/activity
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {35 39 33 30 65 64 61 38 63 66 61 35 61 62 33 39 30 38 30 30 31 35 34 30 } //1 5930eda8cfa5ab3908001540
$a_01_4 = {6d 49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 mInterstitialAd
$a_01_5 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_03_6 = {63 6f 6d 2f 6e 75 70 75 69 74 2f [0-20] 61 63 74 69 76 69 74 79 2f 4d 6f 63 6b 75 70 41 63 74 69 76 69 74 79 } //1
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_03_6 & 1)*1) >=7
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_D_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_MobiDash_D_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.D!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_01_0 = {60 00 98 00 6f 20 ec 09 98 00 6e 10 91 0f 08 00 52 81 dc 01 b7 91 59 89 dc 01 dd 02 09 04 12 03 12 14 39 02 04 00 12 12 28 02 } //1
$a_01_1 = {62 39 37 62 35 36 63 38 64 62 61 66 37 30 39 63 32 34 30 62 63 61 61 30 32 36 66 61 34 37 61 61 2e 63 6f 6d } //1 b97b56c8dbaf709c240bcaa026fa47aa.com
$a_01_2 = {68 69 64 65 5f 61 70 70 5f 69 63 6f 6e } //1 hide_app_icon
$a_01_3 = {24 74 68 69 73 24 67 65 74 69 6e 73 74 61 6c 6c 64 61 74 65 } //1 $this$getinstalldate
$a_01_4 = {45 6e 64 6c 65 73 73 53 65 72 76 69 63 65 3a 3a 6c 6f 63 6b } //1 EndlessService::lock
$a_01_5 = {53 53 52 65 63 65 69 76 65 72 50 72 6f 78 79 } //1 SSReceiverProxy
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
rule Adware_AndroidOS_MobiDash_D_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.D!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 00 "
strings :
$a_01_0 = {60 00 98 00 6f 20 ec 09 98 00 6e 10 91 0f 08 00 52 81 dc 01 b7 91 59 89 dc 01 dd 02 09 04 12 03 12 14 39 02 04 00 12 12 28 02 } //1
$a_01_1 = {62 39 37 62 35 36 63 38 64 62 61 66 37 30 39 63 32 34 30 62 63 61 61 30 32 36 66 61 34 37 61 61 2e 63 6f 6d } //1 b97b56c8dbaf709c240bcaa026fa47aa.com
$a_01_2 = {68 69 64 65 5f 61 70 70 5f 69 63 6f 6e } //1 hide_app_icon
$a_01_3 = {24 74 68 69 73 24 67 65 74 69 6e 73 74 61 6c 6c 64 61 74 65 } //1 $this$getinstalldate
$a_01_4 = {45 6e 64 6c 65 73 73 53 65 72 76 69 63 65 3a 3a 6c 6f 63 6b } //1 EndlessService::lock
$a_01_5 = {53 53 52 65 63 65 69 76 65 72 50 72 6f 78 79 } //1 SSReceiverProxy
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_E_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_MobiDash_E_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.E!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 6c 75 73 6b 61 63 72 65 77 6d 6f 64 73 2f 61 6d 6f 6e 67 6d 6f 64 73 } //1 com/luskacrewmods/amongmods
$a_01_1 = {2f 73 79 73 74 65 6d 2f 61 70 70 2f 53 75 70 65 72 75 73 65 72 2e 61 70 6b } //1 /system/app/Superuser.apk
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {70 72 6f 70 75 62 6c 69 63 61 2e 64 62 } //3 propublica.db
$a_01_5 = {73 70 69 63 65 37 2e 64 62 } //3 spice7.db
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*3+(#a_01_5 & 1)*3) >=6
rule Adware_AndroidOS_MobiDash_E_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.E!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 6c 75 73 6b 61 63 72 65 77 6d 6f 64 73 2f 61 6d 6f 6e 67 6d 6f 64 73 } //1 com/luskacrewmods/amongmods
$a_01_1 = {2f 73 79 73 74 65 6d 2f 61 70 70 2f 53 75 70 65 72 75 73 65 72 2e 61 70 6b } //1 /system/app/Superuser.apk
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {70 72 6f 70 75 62 6c 69 63 61 2e 64 62 } //3 propublica.db
$a_01_5 = {73 70 69 63 65 37 2e 64 62 } //3 spice7.db
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*3+(#a_01_5 & 1)*3) >=6
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_F_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_MobiDash_F_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.F!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 66 69 72 65 73 74 72 65 61 6d 2f 74 69 74 61 6e 63 6f 6e 71 75 65 73 74 } //1 com/firestream/titanconquest
$a_01_1 = {2f 73 79 73 74 65 6d 2f 61 70 70 2f 53 75 70 65 72 75 73 65 72 2e 61 70 6b } //1 /system/app/Superuser.apk
$a_01_2 = {6d 6f 62 69 6c 65 61 64 73 } //1 mobileads
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_5 = {74 69 74 61 6e 63 6f 6e 71 75 65 73 74 2e 63 6f 6d } //1 titanconquest.com
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
rule Adware_AndroidOS_MobiDash_F_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.F!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 66 69 72 65 73 74 72 65 61 6d 2f 74 69 74 61 6e 63 6f 6e 71 75 65 73 74 } //1 com/firestream/titanconquest
$a_01_1 = {2f 73 79 73 74 65 6d 2f 61 70 70 2f 53 75 70 65 72 75 73 65 72 2e 61 70 6b } //1 /system/app/Superuser.apk
$a_01_2 = {6d 6f 62 69 6c 65 61 64 73 } //1 mobileads
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_5 = {74 69 74 61 6e 63 6f 6e 71 75 65 73 74 2e 63 6f 6d } //1 titanconquest.com
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_G_MTB.yar
+12 -12
View File
@@ -1,13 +1,13 @@
rule Adware_AndroidOS_MobiDash_G_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.G!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 03 00 00 "
strings :
$a_03_0 = {38 03 57 00 22 01 0e 08 1a 04 ?? 4b 70 30 ?? ?? 71 04 12 14 6e 20 ?? ?? 41 00 0c 04 12 35 } //1
$a_03_1 = {22 01 89 08 70 10 ?? ?? 01 00 6e 10 ?? ?? 01 00 0c 00 54 21 54 1b 6e 20 ?? ?? 01 00 } //1
$a_03_2 = {0a 00 38 00 08 00 54 a0 53 1b 6e 10 ?? ?? 00 00 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=2
rule Adware_AndroidOS_MobiDash_G_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.G!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 03 00 00 "
strings :
$a_03_0 = {38 03 57 00 22 01 0e 08 1a 04 ?? 4b 70 30 ?? ?? 71 04 12 14 6e 20 ?? ?? 41 00 0c 04 12 35 } //1
$a_03_1 = {22 01 89 08 70 10 ?? ?? 01 00 6e 10 ?? ?? 01 00 0c 00 54 21 54 1b 6e 20 ?? ?? 01 00 } //1
$a_03_2 = {0a 00 38 00 08 00 54 a0 53 1b 6e 10 ?? ?? 00 00 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=2
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_H_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_MobiDash_H_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.H!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 74 6d 66 6c 61 62 73 2f 73 77 69 6d 6d 69 6e 67 74 75 74 6f 72 69 61 6c 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //2 com/tmflabs/swimmingtutorial/MainActivity
$a_01_1 = {6f 6d 2f 6f 73 73 69 62 75 73 73 6f 66 74 77 61 72 65 2f 64 65 61 64 70 69 78 65 6c 74 65 73 74 2f 50 72 6f 76 69 64 65 72 } //2 om/ossibussoftware/deadpixeltest/Provider
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {64 65 61 64 70 69 78 65 6c 74 65 73 74 2e 64 62 } //1 deadpixeltest.db
$a_01_5 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
rule Adware_AndroidOS_MobiDash_H_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.H!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 74 6d 66 6c 61 62 73 2f 73 77 69 6d 6d 69 6e 67 74 75 74 6f 72 69 61 6c 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //2 com/tmflabs/swimmingtutorial/MainActivity
$a_01_1 = {6f 6d 2f 6f 73 73 69 62 75 73 73 6f 66 74 77 61 72 65 2f 64 65 61 64 70 69 78 65 6c 74 65 73 74 2f 50 72 6f 76 69 64 65 72 } //2 om/ossibussoftware/deadpixeltest/Provider
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {64 65 61 64 70 69 78 65 6c 74 65 73 74 2e 64 62 } //1 deadpixeltest.db
$a_01_5 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_K_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_MobiDash_K_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.K!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {73 6f 6e 69 64 6f 73 70 61 72 61 64 6f 72 6d 69 72 2e 64 62 } //1 sonidosparadormir.db
$a_01_1 = {6d 6f 62 69 6c 65 61 64 73 } //1 mobileads
$a_01_2 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_MobiDash_K_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.K!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {73 6f 6e 69 64 6f 73 70 61 72 61 64 6f 72 6d 69 72 2e 64 62 } //1 sonidosparadormir.db
$a_01_1 = {6d 6f 62 69 6c 65 61 64 73 } //1 mobileads
$a_01_2 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_L_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_MobiDash_L_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.L!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 66 66 73 2f 73 75 70 65 72 68 65 72 6f 65 73 2f 6a 75 6e 69 6f 72 2f 50 72 6f 76 69 64 65 72 } //1 com/ffs/superheroes/junior/Provider
$a_01_1 = {6a 75 6e 69 6f 72 2e 64 62 } //1 junior.db
$a_01_2 = {6d 6b 64 69 72 43 68 65 63 6b 65 64 } //1 mkdirChecked
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_MobiDash_L_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.L!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 66 66 73 2f 73 75 70 65 72 68 65 72 6f 65 73 2f 6a 75 6e 69 6f 72 2f 50 72 6f 76 69 64 65 72 } //1 com/ffs/superheroes/junior/Provider
$a_01_1 = {6a 75 6e 69 6f 72 2e 64 62 } //1 junior.db
$a_01_2 = {6d 6b 64 69 72 43 68 65 63 6b 65 64 } //1 mkdirChecked
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_M_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_MobiDash_M_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.M!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 61 6d 6f 73 6d 6f 62 69 6c 65 2f 72 6f 6f 74 63 68 65 63 6b 2f 52 6f 6f 74 43 68 65 63 6b 41 63 74 69 76 69 74 79 } //1 com/amosmobile/rootcheck/RootCheckActivity
$a_01_1 = {73 68 61 72 65 4d 79 44 61 74 61 } //1 shareMyData
$a_03_2 = {6d 61 69 6c 74 6f ?? 61 6d 6f 73 6d 6f 62 69 6c 65 35 35 40 67 6d 61 69 6c 2e 63 6f 6d } //1
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
$a_01_4 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_AndroidOS_MobiDash_M_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.M!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 61 6d 6f 73 6d 6f 62 69 6c 65 2f 72 6f 6f 74 63 68 65 63 6b 2f 52 6f 6f 74 43 68 65 63 6b 41 63 74 69 76 69 74 79 } //1 com/amosmobile/rootcheck/RootCheckActivity
$a_01_1 = {73 68 61 72 65 4d 79 44 61 74 61 } //1 shareMyData
$a_03_2 = {6d 61 69 6c 74 6f ?? 61 6d 6f 73 6d 6f 62 69 6c 65 35 35 40 67 6d 61 69 6c 2e 63 6f 6d } //1
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
$a_01_4 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_O_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_MobiDash_O_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.O!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {61 70 70 37 39 34 37 33 34 2e 64 62 } //1 app794734.db
$a_01_1 = {63 6f 6d 2f 61 6c 6c 61 68 77 61 6c 6c 70 61 70 65 72 2f 68 64 77 61 6c 6c 70 61 70 65 72 2f 61 6c 6c 61 68 2f 69 73 6c 61 6d 69 63 2f 6b 61 6c 69 67 72 61 66 69 2f 61 70 70 37 39 34 37 33 34 } //1 com/allahwallpaper/hdwallpaper/allah/islamic/kaligrafi/app794734
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_AndroidOS_MobiDash_O_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.O!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {61 70 70 37 39 34 37 33 34 2e 64 62 } //1 app794734.db
$a_01_1 = {63 6f 6d 2f 61 6c 6c 61 68 77 61 6c 6c 70 61 70 65 72 2f 68 64 77 61 6c 6c 70 61 70 65 72 2f 61 6c 6c 61 68 2f 69 73 6c 61 6d 69 63 2f 6b 61 6c 69 67 72 61 66 69 2f 61 70 70 37 39 34 37 33 34 } //1 com/allahwallpaper/hdwallpaper/allah/islamic/kaligrafi/app794734
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_P_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_MobiDash_P_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.P!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {6f 72 67 2f 63 6f 63 6f 73 32 64 78 2f 6a 61 6d 6d 73 2f 68 6f 68 6f 68 6f 2f 50 72 6f 76 69 64 65 72 } //1 org/cocos2dx/jamms/hohoho/Provider
$a_01_1 = {68 6f 68 6f 68 6f 2e 64 62 } //1 hohoho.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_MobiDash_P_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.P!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {6f 72 67 2f 63 6f 63 6f 73 32 64 78 2f 6a 61 6d 6d 73 2f 68 6f 68 6f 68 6f 2f 50 72 6f 76 69 64 65 72 } //1 org/cocos2dx/jamms/hohoho/Provider
$a_01_1 = {68 6f 68 6f 68 6f 2e 64 62 } //1 hohoho.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_Q_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_MobiDash_Q_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.Q!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 64 61 72 61 6d 65 64 69 61 2f 70 65 72 66 75 6d 65 6f 69 6c 2f 50 72 6f 76 69 64 65 72 } //1 com/daramedia/perfumeoil/Provider
$a_01_1 = {70 65 72 66 75 6d 65 6f 69 6c 2e 64 62 } //1 perfumeoil.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_MobiDash_Q_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.Q!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 64 61 72 61 6d 65 64 69 61 2f 70 65 72 66 75 6d 65 6f 69 6c 2f 50 72 6f 76 69 64 65 72 } //1 com/daramedia/perfumeoil/Provider
$a_01_1 = {70 65 72 66 75 6d 65 6f 69 6c 2e 64 62 } //1 perfumeoil.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_R_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_MobiDash_R_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.R!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 73 61 69 6e 74 2f 66 72 61 6e 63 69 73 6c 70 2f 50 72 6f 76 69 64 65 72 } //1 com/saint/francislp/Provider
$a_01_1 = {66 72 61 6e 63 69 73 6c 70 2e 64 62 } //1 francislp.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {66 72 61 6e 63 69 73 6c 70 2e 64 61 74 2e 6a 61 72 } //1 francislp.dat.jar
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_MobiDash_R_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.R!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 73 61 69 6e 74 2f 66 72 61 6e 63 69 73 6c 70 2f 50 72 6f 76 69 64 65 72 } //1 com/saint/francislp/Provider
$a_01_1 = {66 72 61 6e 63 69 73 6c 70 2e 64 62 } //1 francislp.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {66 72 61 6e 63 69 73 6c 70 2e 64 61 74 2e 6a 61 72 } //1 francislp.dat.jar
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_S_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_MobiDash_S_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.S!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 63 79 72 6f 73 65 68 64 6d 6f 76 69 65 2f 62 6f 78 6f 66 66 69 63 65 2f 50 72 6f 76 69 64 65 72 } //1 com/cyrosehdmovie/boxoffice/Provider
$a_01_1 = {62 6f 78 6f 66 66 69 63 65 2e 64 62 } //1 boxoffice.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_MobiDash_S_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.S!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 63 79 72 6f 73 65 68 64 6d 6f 76 69 65 2f 62 6f 78 6f 66 66 69 63 65 2f 50 72 6f 76 69 64 65 72 } //1 com/cyrosehdmovie/boxoffice/Provider
$a_01_1 = {62 6f 78 6f 66 66 69 63 65 2e 64 62 } //1 boxoffice.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_T_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_MobiDash_T_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.T!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_03_0 = {04 00 0c 01 6e 10 ?? ?? 01 00 0c 02 6e 10 ?? ?? 01 00 0c 01 6e 10 ?? ?? 04 00 0c 04 6e 10 ?? ?? 02 00 6e 20 ?? ?? 04 00 0c 04 22 00 ?? ?? ?? ?? ?? ?? 10 00 70 30 ?? ?? 43 00 28 05 0d 04 } //1
$a_01_1 = {61 6e 63 69 65 6e 74 72 6f 6d 65 2e 64 62 } //1 ancientrome.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
$a_01_4 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_5 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
rule Adware_AndroidOS_MobiDash_T_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.T!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_03_0 = {04 00 0c 01 6e 10 ?? ?? 01 00 0c 02 6e 10 ?? ?? 01 00 0c 01 6e 10 ?? ?? 04 00 0c 04 6e 10 ?? ?? 02 00 6e 20 ?? ?? 04 00 0c 04 22 00 ?? ?? ?? ?? ?? ?? 10 00 70 30 ?? ?? 43 00 28 05 0d 04 } //1
$a_01_1 = {61 6e 63 69 65 6e 74 72 6f 6d 65 2e 64 62 } //1 ancientrome.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
$a_01_4 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_5 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_U_MTB.yar
+28 -28
View File
@@ -1,29 +1,29 @@
rule Adware_AndroidOS_MobiDash_U_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.U!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 61 72 64 76 69 65 77 2e 64 62 } //1 cardview.db
$a_01_1 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_2 = {69 64 65 2f 63 72 65 61 74 6f 72 2f 6e 67 61 62 65 61 6e 2f 63 61 72 64 76 69 65 77 } //1 ide/creator/ngabean/cardview
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_4 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
rule Adware_AndroidOS_MobiDash_U_MTB_2{
meta:
description = "Adware:AndroidOS/MobiDash.U!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 74 61 6c 6b 69 6e 67 2f 6e 6f 65 6c 2f 50 72 6f 76 69 64 65 72 } //1 com/talking/noel/Provider
$a_01_1 = {6e 6f 65 6c 2e 64 62 } //1 noel.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
$a_01_4 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_AndroidOS_MobiDash_U_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.U!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 61 72 64 76 69 65 77 2e 64 62 } //1 cardview.db
$a_01_1 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_2 = {69 64 65 2f 63 72 65 61 74 6f 72 2f 6e 67 61 62 65 61 6e 2f 63 61 72 64 76 69 65 77 } //1 ide/creator/ngabean/cardview
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_4 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
rule Adware_AndroidOS_MobiDash_U_MTB_2{
meta:
description = "Adware:AndroidOS/MobiDash.U!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 74 61 6c 6b 69 6e 67 2f 6e 6f 65 6c 2f 50 72 6f 76 69 64 65 72 } //1 com/talking/noel/Provider
$a_01_1 = {6e 6f 65 6c 2e 64 62 } //1 noel.db
$a_01_2 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_3 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
$a_01_4 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_V_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_MobiDash_V_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.V!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 74 68 6f 72 61 70 70 73 2f 69 6e 63 68 65 73 74 6f 63 65 6e 74 69 6d 65 74 65 72 73 2f 50 72 6f 76 69 64 65 72 } //1 com/thorapps/inchestocentimeters/Provider
$a_01_1 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_2 = {69 6e 63 68 65 73 74 6f 63 65 6e 74 69 6d 65 74 65 72 73 2e 64 62 } //1 inchestocentimeters.db
$a_01_3 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_4 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
$a_01_5 = {4f 6e 41 70 70 49 6e 73 74 61 6c 6c 41 64 4c 6f 61 64 65 64 4c 69 73 74 65 6e 65 72 } //1 OnAppInstallAdLoadedListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
rule Adware_AndroidOS_MobiDash_V_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.V!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 74 68 6f 72 61 70 70 73 2f 69 6e 63 68 65 73 74 6f 63 65 6e 74 69 6d 65 74 65 72 73 2f 50 72 6f 76 69 64 65 72 } //1 com/thorapps/inchestocentimeters/Provider
$a_01_1 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_2 = {69 6e 63 68 65 73 74 6f 63 65 6e 74 69 6d 65 74 65 72 73 2e 64 62 } //1 inchestocentimeters.db
$a_01_3 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_4 = {4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 } //1 NotificationListener
$a_01_5 = {4f 6e 41 70 70 49 6e 73 74 61 6c 6c 41 64 4c 6f 61 64 65 64 4c 69 73 74 65 6e 65 72 } //1 OnAppInstallAdLoadedListener
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_Y_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_MobiDash_Y_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.Y!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 70 72 69 6f 72 69 74 79 68 65 61 6c 74 68 2f 6d 65 6d 62 65 72 70 6f 72 74 61 6c } //1 com/priorityhealth/memberportal
$a_01_1 = {6d 65 6d 62 65 72 70 6f 72 74 61 6c 2e 64 62 } //1 memberportal.db
$a_01_2 = {67 65 74 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 getClassLoader
$a_01_3 = {6c 6f 61 64 4c 69 62 73 } //1 loadLibs
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_MobiDash_Y_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.Y!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 70 72 69 6f 72 69 74 79 68 65 61 6c 74 68 2f 6d 65 6d 62 65 72 70 6f 72 74 61 6c } //1 com/priorityhealth/memberportal
$a_01_1 = {6d 65 6d 62 65 72 70 6f 72 74 61 6c 2e 64 62 } //1 memberportal.db
$a_01_2 = {67 65 74 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 getClassLoader
$a_01_3 = {6c 6f 61 64 4c 69 62 73 } //1 loadLibs
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_MobiDash_Z_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_MobiDash_Z_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.Z!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {4c 63 6f 6d 2f 6b 61 63 79 61 6e 6f 2f 6d 65 67 61 73 65 6e 61 } //1 Lcom/kacyano/megasena
$a_01_1 = {4c 63 6f 6d 2f 62 75 62 62 6c 69 6e 67 69 73 6f 2f 64 6d 76 63 68 69 6e 65 73 65 } //1 Lcom/bubblingiso/dmvchinese
$a_01_2 = {64 6d 76 63 68 69 6e 65 73 65 2e 64 62 } //1 dmvchinese.db
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_4 = {73 65 6e 64 4e 6f 74 69 66 69 63 61 74 69 6f 6e } //1 sendNotification
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_AndroidOS_MobiDash_Z_MTB{
meta:
description = "Adware:AndroidOS/MobiDash.Z!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {4c 63 6f 6d 2f 6b 61 63 79 61 6e 6f 2f 6d 65 67 61 73 65 6e 61 } //1 Lcom/kacyano/megasena
$a_01_1 = {4c 63 6f 6d 2f 62 75 62 62 6c 69 6e 67 69 73 6f 2f 64 6d 76 63 68 69 6e 65 73 65 } //1 Lcom/bubblingiso/dmvchinese
$a_01_2 = {64 6d 76 63 68 69 6e 65 73 65 2e 64 62 } //1 dmvchinese.db
$a_01_3 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_4 = {73 65 6e 64 4e 6f 74 69 66 69 63 61 74 69 6f 6e } //1 sendNotification
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AE_MTB.yar
+12 -12
View File
@@ -1,13 +1,13 @@
rule Adware_AndroidOS_Mobidash_AE_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.AE!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 41 70 70 79 54 65 63 68 2f 61 70 70 79 74 65 63 68 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //1 com/AppyTech/appytech/MainActivity
$a_01_1 = {44 45 4d 41 4e 44 45 5f 53 54 4f 52 41 47 45 5f 54 4f 5f 44 41 54 41 } //1 DEMANDE_STORAGE_TO_DATA
$a_01_2 = {4e 4f 4d 5f 4c 49 53 54 45 5f 47 52 49 44 5f 43 4f 50 59 } //1 NOM_LISTE_GRID_COPY
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
rule Adware_AndroidOS_Mobidash_AE_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.AE!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 41 70 70 79 54 65 63 68 2f 61 70 70 79 74 65 63 68 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //1 com/AppyTech/appytech/MainActivity
$a_01_1 = {44 45 4d 41 4e 44 45 5f 53 54 4f 52 41 47 45 5f 54 4f 5f 44 41 54 41 } //1 DEMANDE_STORAGE_TO_DATA
$a_01_2 = {4e 4f 4d 5f 4c 49 53 54 45 5f 47 52 49 44 5f 43 4f 50 59 } //1 NOM_LISTE_GRID_COPY
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_I_MTB.yar
+31 -31
View File
@@ -1,32 +1,32 @@
rule Adware_AndroidOS_Mobidash_I_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.I!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {73 70 65 6c 6c 69 6e 67 62 75 67 68 61 6e 67 6d 61 6e 6c 69 74 65 2e 64 62 } //2 spellingbughangmanlite.db
$a_01_1 = {6d 61 78 68 65 61 6c 74 68 63 61 72 65 2e 64 62 } //2 maxhealthcare.db
$a_01_2 = {63 6f 6d 2f 72 65 61 6c 74 65 73 74 2f 6e 61 6d 65 6d 65 74 65 72 2f 6c 6f 76 65 63 61 6c 63 75 6c 61 74 6f 72 2f 61 63 74 69 76 69 74 69 65 73 } //1 com/realtest/namemeter/lovecalculator/activities
$a_01_3 = {72 6b 61 64 68 69 73 68 2f 61 6c 74 65 72 } //1 rkadhish/alter
$a_01_4 = {64 72 61 6d 61 69 6e 66 6f 74 65 63 68 2e 63 6f 6d 2f 61 70 69 2f 6d 69 6c 65 73 74 6f 6e 65 2f 77 6f 72 64 2e 70 68 70 } //1 dramainfotech.com/api/milestone/word.php
$a_01_5 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_6 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
rule Adware_AndroidOS_Mobidash_I_MTB_2{
meta:
description = "Adware:AndroidOS/Mobidash.I!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,15 00 15 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 73 69 61 2f 72 6d 73 } //1 com/sia/rms
$a_01_1 = {63 6f 6d 2f 4b 61 79 61 6c 2f 53 77 69 70 79 47 6f 61 6c } //1 com/Kayal/SwipyGoal
$a_01_2 = {6f 72 67 2f 63 6f 63 6f 73 32 64 78 2f 63 70 70 } //1 org/cocos2dx/cpp
$a_01_3 = {2f 73 62 43 39 71 37 } //1 /sbC9q7
$a_03_4 = {13 00 00 10 23 01 ?? ?? 12 02 6e 40 ?? ?? 15 02 0a 03 3d 03 06 00 6e 40 ?? ?? 16 32 28 f6 0e 00 } //10
$a_03_5 = {5e 00 00 00 54 40 ?? ?? 39 00 5b 00 71 10 ?? ?? 05 00 1a 00 ?? ?? 6e 20 ?? ?? 05 00 0c 01 6e 10 ?? ?? 01 00 0c 02 6e 10 ?? ?? 05 00 0c 05 6e 10 ?? ?? 01 00 0c 03 38 03 13 00 6e 10 ?? ?? 01 00 0c 03 6e 10 ?? ?? 03 00 0a 03 39 03 09 00 6e 10 ?? ?? 01 00 0c 01 6e 10 ?? ?? 01 00 } //10
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*10+(#a_03_5 & 1)*10) >=21
rule Adware_AndroidOS_Mobidash_I_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.I!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {73 70 65 6c 6c 69 6e 67 62 75 67 68 61 6e 67 6d 61 6e 6c 69 74 65 2e 64 62 } //2 spellingbughangmanlite.db
$a_01_1 = {6d 61 78 68 65 61 6c 74 68 63 61 72 65 2e 64 62 } //2 maxhealthcare.db
$a_01_2 = {63 6f 6d 2f 72 65 61 6c 74 65 73 74 2f 6e 61 6d 65 6d 65 74 65 72 2f 6c 6f 76 65 63 61 6c 63 75 6c 61 74 6f 72 2f 61 63 74 69 76 69 74 69 65 73 } //1 com/realtest/namemeter/lovecalculator/activities
$a_01_3 = {72 6b 61 64 68 69 73 68 2f 61 6c 74 65 72 } //1 rkadhish/alter
$a_01_4 = {64 72 61 6d 61 69 6e 66 6f 74 65 63 68 2e 63 6f 6d 2f 61 70 69 2f 6d 69 6c 65 73 74 6f 6e 65 2f 77 6f 72 64 2e 70 68 70 } //1 dramainfotech.com/api/milestone/word.php
$a_01_5 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_6 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
rule Adware_AndroidOS_Mobidash_I_MTB_2{
meta:
description = "Adware:AndroidOS/Mobidash.I!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,15 00 15 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 73 69 61 2f 72 6d 73 } //1 com/sia/rms
$a_01_1 = {63 6f 6d 2f 4b 61 79 61 6c 2f 53 77 69 70 79 47 6f 61 6c } //1 com/Kayal/SwipyGoal
$a_01_2 = {6f 72 67 2f 63 6f 63 6f 73 32 64 78 2f 63 70 70 } //1 org/cocos2dx/cpp
$a_01_3 = {2f 73 62 43 39 71 37 } //1 /sbC9q7
$a_03_4 = {13 00 00 10 23 01 ?? ?? 12 02 6e 40 ?? ?? 15 02 0a 03 3d 03 06 00 6e 40 ?? ?? 16 32 28 f6 0e 00 } //10
$a_03_5 = {5e 00 00 00 54 40 ?? ?? 39 00 5b 00 71 10 ?? ?? 05 00 1a 00 ?? ?? 6e 20 ?? ?? 05 00 0c 01 6e 10 ?? ?? 01 00 0c 02 6e 10 ?? ?? 05 00 0c 05 6e 10 ?? ?? 01 00 0c 03 38 03 13 00 6e 10 ?? ?? 01 00 0c 03 6e 10 ?? ?? 03 00 0a 03 39 03 09 00 6e 10 ?? ?? 01 00 0c 01 6e 10 ?? ?? 01 00 } //10
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*10+(#a_03_5 & 1)*10) >=21
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_J_MTB.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_AndroidOS_Mobidash_J_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.J!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,0c 00 0c 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 69 64 6c 65 6c 61 77 66 69 72 6d 2f 65 6d 70 69 72 65 74 79 63 6f 6f 6e 67 61 6d 65 } //10 com/idlelawfirm/empiretycoongame
$a_01_1 = {76 69 6a 61 2f 73 75 6d 6d 65 72 2f 62 65 61 63 68 2f 6c 61 75 6e 63 68 65 72 } //10 vija/summer/beach/launcher
$a_01_2 = {7a 65 78 69 63 61 2f 61 70 70 2f 73 75 6d 6d 65 72 2f 77 61 6c 6c 70 61 70 65 72 73 } //10 zexica/app/summer/wallpapers
$a_01_3 = {2f 65 78 70 6f 2f 70 72 6f 67 72 65 73 73 79 6f 75 72 73 65 6c 66 2f } //10 /expo/progressyourself/
$a_01_4 = {6f 6e 55 70 67 72 61 64 65 } //1 onUpgrade
$a_01_5 = {67 65 74 50 61 63 6b 61 67 65 49 6e 66 6f } //1 getPackageInfo
condition:
((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=12
rule Adware_AndroidOS_Mobidash_J_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.J!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,0c 00 0c 00 06 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 69 64 6c 65 6c 61 77 66 69 72 6d 2f 65 6d 70 69 72 65 74 79 63 6f 6f 6e 67 61 6d 65 } //10 com/idlelawfirm/empiretycoongame
$a_01_1 = {76 69 6a 61 2f 73 75 6d 6d 65 72 2f 62 65 61 63 68 2f 6c 61 75 6e 63 68 65 72 } //10 vija/summer/beach/launcher
$a_01_2 = {7a 65 78 69 63 61 2f 61 70 70 2f 73 75 6d 6d 65 72 2f 77 61 6c 6c 70 61 70 65 72 73 } //10 zexica/app/summer/wallpapers
$a_01_3 = {2f 65 78 70 6f 2f 70 72 6f 67 72 65 73 73 79 6f 75 72 73 65 6c 66 2f } //10 /expo/progressyourself/
$a_01_4 = {6f 6e 55 70 67 72 61 64 65 } //1 onUpgrade
$a_01_5 = {67 65 74 50 61 63 6b 61 67 65 49 6e 66 6f } //1 getPackageInfo
condition:
((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=12
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_N_MTB.yar
+10 -10
View File
@@ -1,11 +1,11 @@
rule Adware_AndroidOS_Mobidash_N_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.N!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_03_0 = {39 00 3d 00 71 10 ?? ?? 03 00 1a 00 ?? ?? 6e 20 ?? ?? 03 00 0c 01 6e 10 ?? ?? 01 00 6e 10 ?? ?? 01 00 0c 01 6e 10 ?? ?? 03 00 0c 03 6e 20 ?? ?? 03 00 0c 03 22 00 ?? ?? 70 20 ?? ?? 10 00 70 30 ?? ?? 32 00 28 05 } //1
condition:
((#a_03_0 & 1)*1) >=1
rule Adware_AndroidOS_Mobidash_N_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.N!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_03_0 = {39 00 3d 00 71 10 ?? ?? 03 00 1a 00 ?? ?? 6e 20 ?? ?? 03 00 0c 01 6e 10 ?? ?? 01 00 6e 10 ?? ?? 01 00 0c 01 6e 10 ?? ?? 03 00 0c 03 6e 20 ?? ?? 03 00 0c 03 22 00 ?? ?? 70 20 ?? ?? 10 00 70 30 ?? ?? 32 00 28 05 } //1
condition:
((#a_03_0 & 1)*1) >=1
}
Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_W_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_Mobidash_W_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.W!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_03_0 = {13 00 00 10 23 01 ?? ?? 12 02 6e 40 ?? ?? 15 02 0a 03 3d 03 06 00 6e 40 ?? ?? 16 32 28 f6 0e 00 } //1
$a_01_1 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {70 69 6e 66 6f } //1 pinfo
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_AndroidOS_Mobidash_W_MTB{
meta:
description = "Adware:AndroidOS/Mobidash.W!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_03_0 = {13 00 00 10 23 01 ?? ?? 12 02 6e 40 ?? ?? 15 02 0a 03 3d 03 06 00 6e 40 ?? ?? 16 32 28 f6 0e 00 } //1
$a_01_1 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_2 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_3 = {70 69 6e 66 6f } //1 pinfo
condition:
((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/AndroidOS/Obtes/Adware_AndroidOS_Obtes_A_MTB.yar
+10 -10
View File
@@ -1,11 +1,11 @@
rule Adware_AndroidOS_Obtes_A_MTB{
meta:
description = "Adware:AndroidOS/Obtes.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_03_0 = {35 62 78 00 12 00 6e 30 ?? ?? 47 00 12 00 6e 30 ?? ?? 49 00 0c 00 1f 00 1a 00 6e 10 ?? ?? 00 00 0b 0a 13 00 2f 00 33 02 2b 00 84 a0 23 00 2c 00 12 1a 23 aa 2e 00 12 0b 4d 00 0a 0b 6e 30 ?? ?? 48 0a 21 0a d8 0a 0a fe 48 0a 00 0a 21 0b d8 0b 0b fe 12 1c 48 0c 00 0c 4f 0c 00 0b 12 1b 4f 0a 00 0b 54 ea ?? ?? 12 0b 71 20 ?? ?? b0 00 0c 00 4d 00 0a 02 d8 00 02 01 } //1
condition:
((#a_03_0 & 1)*1) >=1
rule Adware_AndroidOS_Obtes_A_MTB{
meta:
description = "Adware:AndroidOS/Obtes.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_03_0 = {35 62 78 00 12 00 6e 30 ?? ?? 47 00 12 00 6e 30 ?? ?? 49 00 0c 00 1f 00 1a 00 6e 10 ?? ?? 00 00 0b 0a 13 00 2f 00 33 02 2b 00 84 a0 23 00 2c 00 12 1a 23 aa 2e 00 12 0b 4d 00 0a 0b 6e 30 ?? ?? 48 0a 21 0a d8 0a 0a fe 48 0a 00 0a 21 0b d8 0b 0b fe 12 1c 48 0c 00 0c 4f 0c 00 0b 12 1b 4f 0a 00 0b 54 ea ?? ?? 12 0b 71 20 ?? ?? b0 00 0c 00 4d 00 0a 02 d8 00 02 01 } //1
condition:
((#a_03_0 & 1)*1) >=1
}
Adware/AndroidOS/Peterhodkinsoner/Adware_AndroidOS_Peterhodkinsoner_A.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_AndroidOS_Peterhodkinsoner_A{
meta:
description = "Adware:AndroidOS/Peterhodkinsoner.A,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 04 00 00 "
strings :
$a_00_0 = {70 65 74 65 72 68 6f 64 6b 69 6e 73 6f 6e 65 72 } //2 peterhodkinsoner
$a_00_1 = {4c 67 4d 4e 42 77 30 48 41 67 51 56 55 77 59 59 42 77 39 42 48 68 45 45 46 31 59 4a 45 68 49 53 51 78 63 56 55 77 67 53 41 67 55 56 55 77 73 5a 42 6c 59 52 45 68 59 44 54 51 3d 3d } //2 LgMNBw0HAgQVUwYYBw9BHhEEF1YJEhISQxcVUwgSAgUVUwsZBlYREhYDTQ==
$a_00_2 = {4c 68 63 4e 46 51 73 46 44 68 4d 46 55 77 63 62 44 41 55 45 55 78 51 57 47 68 6f 4f 45 67 42 58 44 78 4d 50 46 42 41 66 51 78 6b 48 55 31 56 5a } //2 LhcNFQsFDhMFUwcbDAUEUxQWGhoOEgBXDxMPFBAfQxkHU1VZ
$a_00_3 = {4c 68 63 56 45 41 77 53 45 56 67 51 42 67 73 44 42 69 51 45 41 77 67 57 41 42 4d 4d 46 67 6f 44 53 78 6f 49 42 77 45 46 41 68 70 49 } //1 LhcVEAwSEVgQBgsDBiQEAwgWABMMFgoDSxoIBwEFAhpI
condition:
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1) >=7
rule Adware_AndroidOS_Peterhodkinsoner_A{
meta:
description = "Adware:AndroidOS/Peterhodkinsoner.A,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 04 00 00 "
strings :
$a_00_0 = {70 65 74 65 72 68 6f 64 6b 69 6e 73 6f 6e 65 72 } //2 peterhodkinsoner
$a_00_1 = {4c 67 4d 4e 42 77 30 48 41 67 51 56 55 77 59 59 42 77 39 42 48 68 45 45 46 31 59 4a 45 68 49 53 51 78 63 56 55 77 67 53 41 67 55 56 55 77 73 5a 42 6c 59 52 45 68 59 44 54 51 3d 3d } //2 LgMNBw0HAgQVUwYYBw9BHhEEF1YJEhISQxcVUwgSAgUVUwsZBlYREhYDTQ==
$a_00_2 = {4c 68 63 4e 46 51 73 46 44 68 4d 46 55 77 63 62 44 41 55 45 55 78 51 57 47 68 6f 4f 45 67 42 58 44 78 4d 50 46 42 41 66 51 78 6b 48 55 31 56 5a } //2 LhcNFQsFDhMFUwcbDAUEUxQWGhoOEgBXDxMPFBAfQxkHU1VZ
$a_00_3 = {4c 68 63 56 45 41 77 53 45 56 67 51 42 67 73 44 42 69 51 45 41 77 67 57 41 42 4d 4d 46 67 6f 44 53 78 6f 49 42 77 45 46 41 68 70 49 } //1 LhcVEAwSEVgQBgsDBiQEAwgWABMMFgoDSxoIBwEFAhpI
condition:
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1) >=7
}
Adware/AndroidOS/Pushads/Adware_AndroidOS_Pushads_U.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_AndroidOS_Pushads_U{
meta:
description = "Adware:AndroidOS/Pushads.U,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {67 65 74 6d 4a 6d 4d 6f 6e 65 79 } //1 getmJmMoney
$a_01_1 = {67 65 74 49 6d 67 73 5f 75 72 6c 32 } //1 getImgs_url2
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
rule Adware_AndroidOS_Pushads_U{
meta:
description = "Adware:AndroidOS/Pushads.U,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {67 65 74 6d 4a 6d 4d 6f 6e 65 79 } //1 getmJmMoney
$a_01_1 = {67 65 74 49 6d 67 73 5f 75 72 6c 32 } //1 getImgs_url2
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Adware/AndroidOS/SAgent/Adware_AndroidOS_SAgent_A_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_SAgent_A_MTB{
meta:
description = "Adware:AndroidOS/SAgent.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 61 70 70 61 73 61 6e 2f 56 69 64 65 6f 5f 4c 69 73 74 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //1 com/appasan/Video_List/MainActivity
$a_01_1 = {67 6f 54 6f 56 69 73 69 74 73 61 7a } //1 goToVisitsaz
$a_01_2 = {69 63 61 6e 68 61 7a 69 70 2e 63 6f 6d } //1 icanhazip.com
$a_01_3 = {73 65 74 41 64 4c 69 73 74 65 6e 65 72 } //1 setAdListener
$a_01_4 = {2f 6d 6e 74 2f 73 64 63 61 72 64 2f 44 6f 77 6e 6c 6f 61 64 2f } //1 /mnt/sdcard/Download/
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_AndroidOS_SAgent_A_MTB{
meta:
description = "Adware:AndroidOS/SAgent.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {63 6f 6d 2f 61 70 70 61 73 61 6e 2f 56 69 64 65 6f 5f 4c 69 73 74 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //1 com/appasan/Video_List/MainActivity
$a_01_1 = {67 6f 54 6f 56 69 73 69 74 73 61 7a } //1 goToVisitsaz
$a_01_2 = {69 63 61 6e 68 61 7a 69 70 2e 63 6f 6d } //1 icanhazip.com
$a_01_3 = {73 65 74 41 64 4c 69 73 74 65 6e 65 72 } //1 setAdListener
$a_01_4 = {2f 6d 6e 74 2f 73 64 63 61 72 64 2f 44 6f 77 6e 6c 6f 61 64 2f } //1 /mnt/sdcard/Download/
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/AndroidOS/SAgnt/Adware_AndroidOS_SAgnt_A_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_SAgnt_A_MTB{
meta:
description = "Adware:AndroidOS/SAgnt.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 05 00 00 "
strings :
$a_03_0 = {6d 6f 62 70 61 72 6b 2f 63 6f 6d 2f [0-20] 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //2
$a_01_1 = {4d 6f 62 50 61 72 6b 2e 61 70 6b } //2 MobPark.apk
$a_01_2 = {67 65 74 49 6e 73 74 61 6c 6c 44 69 72 } //2 getInstallDir
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {70 6f 73 74 41 64 6d 6f 62 4c 6f 67 } //1 postAdmobLog
condition:
((#a_03_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=7
rule Adware_AndroidOS_SAgnt_A_MTB{
meta:
description = "Adware:AndroidOS/SAgnt.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 05 00 00 "
strings :
$a_03_0 = {6d 6f 62 70 61 72 6b 2f 63 6f 6d 2f [0-20] 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //2
$a_01_1 = {4d 6f 62 50 61 72 6b 2e 61 70 6b } //2 MobPark.apk
$a_01_2 = {67 65 74 49 6e 73 74 61 6c 6c 44 69 72 } //2 getInstallDir
$a_01_3 = {49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 } //1 InterstitialAd
$a_01_4 = {70 6f 73 74 41 64 6d 6f 62 4c 6f 67 } //1 postAdmobLog
condition:
((#a_03_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=7
}
Adware/AndroidOS/SAgnt/Adware_AndroidOS_SAgnt_B_MTB.yar
+16 -16
View File
@@ -1,17 +1,17 @@
rule Adware_AndroidOS_SAgnt_B_MTB{
meta:
description = "Adware:AndroidOS/SAgnt.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {72 75 2f 6d 61 69 6c 2f 75 73 61 2f 61 6e 64 72 6f 69 64 2f 6d 79 74 61 72 67 65 74 2f 61 64 73 } //1 ru/mail/usa/android/mytarget/ads
$a_01_1 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_2 = {2f 73 79 73 74 65 6d 2f 61 70 70 2f 53 75 70 65 72 75 73 65 72 2e 61 70 6b } //1 /system/app/Superuser.apk
$a_01_3 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_4 = {4f 6e 41 70 70 49 6e 73 74 61 6c 6c 41 64 4c 6f 61 64 65 64 4c 69 73 74 65 6e 65 72 } //1 OnAppInstallAdLoadedListener
$a_01_5 = {67 65 74 4c 61 75 6e 63 68 49 6e 74 65 6e 74 46 6f 72 50 61 63 6b 61 67 65 } //1 getLaunchIntentForPackage
$a_01_6 = {73 65 74 4a 61 76 61 53 63 72 69 70 74 45 6e 61 62 6c 65 64 } //1 setJavaScriptEnabled
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
rule Adware_AndroidOS_SAgnt_B_MTB{
meta:
description = "Adware:AndroidOS/SAgnt.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {72 75 2f 6d 61 69 6c 2f 75 73 61 2f 61 6e 64 72 6f 69 64 2f 6d 79 74 61 72 67 65 74 2f 61 64 73 } //1 ru/mail/usa/android/mytarget/ads
$a_01_1 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
$a_01_2 = {2f 73 79 73 74 65 6d 2f 61 70 70 2f 53 75 70 65 72 75 73 65 72 2e 61 70 6b } //1 /system/app/Superuser.apk
$a_01_3 = {4d 6f 62 69 6c 65 41 64 73 } //1 MobileAds
$a_01_4 = {4f 6e 41 70 70 49 6e 73 74 61 6c 6c 41 64 4c 6f 61 64 65 64 4c 69 73 74 65 6e 65 72 } //1 OnAppInstallAdLoadedListener
$a_01_5 = {67 65 74 4c 61 75 6e 63 68 49 6e 74 65 6e 74 46 6f 72 50 61 63 6b 61 67 65 } //1 getLaunchIntentForPackage
$a_01_6 = {73 65 74 4a 61 76 61 53 63 72 69 70 74 45 6e 61 62 6c 65 64 } //1 setJavaScriptEnabled
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
Adware/AndroidOS/Viser/Adware_AndroidOS_Viser_A_MTB.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_AndroidOS_Viser_A_MTB{
meta:
description = "Adware:AndroidOS/Viser.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,0d 00 0d 00 05 00 00 "
strings :
$a_01_0 = {2e 76 73 65 72 76 2e 6d 6f 62 69 2f 64 65 6c 69 76 65 72 79 2f 74 69 2e 70 68 70 } //10 .vserv.mobi/delivery/ti.php
$a_01_1 = {2e 76 73 65 72 76 2e 6d 6f 62 69 2f 74 65 73 74 2f 74 69 2e 70 68 70 } //10 .vserv.mobi/test/ti.php
$a_01_2 = {2f 56 73 65 72 76 41 64 } //1 /VservAd
$a_01_3 = {6d 75 73 74 53 65 65 41 64 4d 73 67 } //1 mustSeeAdMsg
$a_01_4 = {63 61 6c 6c 4b 69 6c 6c 50 72 6f 63 65 73 73 } //1 callKillProcess
condition:
((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=13
rule Adware_AndroidOS_Viser_A_MTB{
meta:
description = "Adware:AndroidOS/Viser.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,0d 00 0d 00 05 00 00 "
strings :
$a_01_0 = {2e 76 73 65 72 76 2e 6d 6f 62 69 2f 64 65 6c 69 76 65 72 79 2f 74 69 2e 70 68 70 } //10 .vserv.mobi/delivery/ti.php
$a_01_1 = {2e 76 73 65 72 76 2e 6d 6f 62 69 2f 74 65 73 74 2f 74 69 2e 70 68 70 } //10 .vserv.mobi/test/ti.php
$a_01_2 = {2f 56 73 65 72 76 41 64 } //1 /VservAd
$a_01_3 = {6d 75 73 74 53 65 65 41 64 4d 73 67 } //1 mustSeeAdMsg
$a_01_4 = {63 61 6c 6c 4b 69 6c 6c 50 72 6f 63 65 73 73 } //1 callKillProcess
condition:
((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=13
}
Adware/AndroidOS/Vuad/Adware_AndroidOS_Vuad_B_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_AndroidOS_Vuad_B_MTB{
meta:
description = "Adware:AndroidOS/Vuad.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {35 02 16 00 48 03 06 02 62 04 9e 26 94 05 02 01 48 04 04 05 b7 43 da 04 02 1f d4 44 fb 00 b7 43 8d 33 4f 03 06 02 d8 02 02 01 28 eb } //1
$a_01_1 = {62 00 00 00 14 00 10 00 00 00 14 01 0f 00 00 00 90 00 00 01 94 00 00 01 3c 00 05 00 2a 00 53 00 00 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
rule Adware_AndroidOS_Vuad_B_MTB{
meta:
description = "Adware:AndroidOS/Vuad.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {35 02 16 00 48 03 06 02 62 04 9e 26 94 05 02 01 48 04 04 05 b7 43 da 04 02 1f d4 44 fb 00 b7 43 8d 33 4f 03 06 02 d8 02 02 01 28 eb } //1
$a_01_1 = {62 00 00 00 14 00 10 00 00 00 14 01 0f 00 00 00 90 00 00 01 94 00 00 01 3c 00 05 00 2a 00 53 00 00 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Adware/AndroidOS/Vuad/Adware_AndroidOS_Vuad_D_MTB.yar
+16 -16
View File
@@ -1,17 +1,17 @@
rule Adware_AndroidOS_Vuad_D_MTB{
meta:
description = "Adware:AndroidOS/Vuad.D!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_00_0 = {63 6d 2f 72 6c 74 65 63 68 2f 67 6c 6f 62 61 6c } //1 cm/rltech/global
$a_00_1 = {69 6e 73 74 61 6c 6c 41 70 70 } //1 installApp
$a_00_2 = {67 65 74 50 68 6f 6e 65 44 61 74 61 } //1 getPhoneData
$a_00_3 = {67 65 74 69 70 61 64 64 72 65 73 73 } //1 getipaddress
$a_00_4 = {67 65 74 50 68 6f 6e 65 43 61 6c 6c 4c 6f 67 } //1 getPhoneCallLog
$a_00_5 = {67 65 74 43 6f 6e 74 61 63 74 4c 69 73 74 } //1 getContactList
$a_00_6 = {4c 6f 63 6b 42 6f 6f 74 43 6f 6d 70 6c 65 74 65 52 65 63 65 69 76 65 72 } //1 LockBootCompleteReceiver
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=5
rule Adware_AndroidOS_Vuad_D_MTB{
meta:
description = "Adware:AndroidOS/Vuad.D!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 07 00 00 "
strings :
$a_00_0 = {63 6d 2f 72 6c 74 65 63 68 2f 67 6c 6f 62 61 6c } //1 cm/rltech/global
$a_00_1 = {69 6e 73 74 61 6c 6c 41 70 70 } //1 installApp
$a_00_2 = {67 65 74 50 68 6f 6e 65 44 61 74 61 } //1 getPhoneData
$a_00_3 = {67 65 74 69 70 61 64 64 72 65 73 73 } //1 getipaddress
$a_00_4 = {67 65 74 50 68 6f 6e 65 43 61 6c 6c 4c 6f 67 } //1 getPhoneCallLog
$a_00_5 = {67 65 74 43 6f 6e 74 61 63 74 4c 69 73 74 } //1 getContactList
$a_00_6 = {4c 6f 63 6b 42 6f 6f 74 43 6f 6d 70 6c 65 74 65 52 65 63 65 69 76 65 72 } //1 LockBootCompleteReceiver
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=5
}
Adware/AndroidOS/Xavier/Adware_AndroidOS_Xavier_A_MTB.yar
+16 -16
View File
@@ -1,17 +1,17 @@
rule Adware_AndroidOS_Xavier_A_MTB{
meta:
description = "Adware:AndroidOS/Xavier.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {58 61 76 69 65 72 43 6f 6e 66 69 67 48 75 62 } //1 XavierConfigHub
$a_01_1 = {6f 6e 49 6e 74 65 72 73 74 69 74 69 61 6c 44 69 73 6d 69 73 73 65 64 } //1 onInterstitialDismissed
$a_01_2 = {63 61 6e 53 68 6f 77 53 74 61 72 74 41 70 70 49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 4f 6e 4c 61 75 6e 63 68 } //1 canShowStartAppInterstitialAdOnLaunch
$a_01_3 = {73 68 6f 77 41 64 4d 6f 62 49 6e 74 65 72 73 74 69 74 69 61 6c } //1 showAdMobInterstitial
$a_01_4 = {63 61 6e 53 68 6f 77 46 42 49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 4f 6e 4c 61 75 6e 63 68 } //1 canShowFBInterstitialAdOnLaunch
$a_01_5 = {73 61 76 65 53 74 61 72 74 41 70 70 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e } //1 saveStartAppConfiguration
$a_01_6 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
rule Adware_AndroidOS_Xavier_A_MTB{
meta:
description = "Adware:AndroidOS/Xavier.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 00 "
strings :
$a_01_0 = {58 61 76 69 65 72 43 6f 6e 66 69 67 48 75 62 } //1 XavierConfigHub
$a_01_1 = {6f 6e 49 6e 74 65 72 73 74 69 74 69 61 6c 44 69 73 6d 69 73 73 65 64 } //1 onInterstitialDismissed
$a_01_2 = {63 61 6e 53 68 6f 77 53 74 61 72 74 41 70 70 49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 4f 6e 4c 61 75 6e 63 68 } //1 canShowStartAppInterstitialAdOnLaunch
$a_01_3 = {73 68 6f 77 41 64 4d 6f 62 49 6e 74 65 72 73 74 69 74 69 61 6c } //1 showAdMobInterstitial
$a_01_4 = {63 61 6e 53 68 6f 77 46 42 49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 4f 6e 4c 61 75 6e 63 68 } //1 canShowFBInterstitialAdOnLaunch
$a_01_5 = {73 61 76 65 53 74 61 72 74 41 70 70 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e } //1 saveStartAppConfiguration
$a_01_6 = {44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 } //1 DexClassLoader
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7
}
Adware/AndroidOS/Zadmo/Adware_AndroidOS_Zadmo_A_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_AndroidOS_Zadmo_A_MTB{
meta:
description = "Adware:AndroidOS/Zadmo.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 00 "
strings :
$a_00_0 = {20 54 a0 d9 51 df 47 ab 4a de 50 f7 3c ca 19 60 d9 56 93 09 a4 31 47 25 4b cc b1 54 8e 9a c2 2e c7 9d 3a 68 3b ae 1b 13 30 c2 47 2a 13 80 dd 13 f0 e4 7b c4 13 79 ec 3a 8d b1 7c e7 4b 71 d4 4e 5d a3 c2 5f ab 1e 49 ea e1 52 8f 6b 28 82 6b 09 93 08 5d 6a 25 60 c8 38 e8 87 94 a8 8f c6 d1 ec 27 3c 3d 2a f8 72 5d f7 cc 31 } //1
$a_00_1 = {44 40 08 9d eb 18 1b 19 79 4c 1b 19 f3 41 1c 18 01 b4 08 bc 53 40 63 40 14 9d 69 18 c9 18 75 4b c9 18 f9 41 09 19 c3 43 0b 43 63 40 0d 9d aa 18 d2 18 71 4b d2 18 1a 23 04 93 da 41 52 18 e3 43 13 43 4b 40 09 9d 28 18 c0 18 6c 4b c0 18 16 23 03 93 d8 41 83 18 c8 43 18 43 50 40 06 9d 2c 19 20 18 67 4c 00 19 11 24 09 94 e0 41 c4 18 d0 43 20 43 58 40 0c 9f 79 18 08 18 62 49 40 18 0b 26 f0 41 0d 96 07 19 d8 43 38 43 60 40 07 99 8a 18 10 18 5d 4a 80 18 04 99 c8 41 c2 19 e0 43 10 43 78 40 0f 99 cb 18 18 18 58 4b c0 18 03 9d e8 41 83 18 f8 43 18 43 50 40 0a 99 0c 19 20 18 54 4c 00 19 09 99 c8 41 c4 18 d0 43 20 43 58 40 12 99 cf 19 38 18 4f 4f c0 19 f0 41 07 19 d8 43 38 43 } //1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=1
rule Adware_AndroidOS_Zadmo_A_MTB{
meta:
description = "Adware:AndroidOS/Zadmo.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 00 "
strings :
$a_00_0 = {20 54 a0 d9 51 df 47 ab 4a de 50 f7 3c ca 19 60 d9 56 93 09 a4 31 47 25 4b cc b1 54 8e 9a c2 2e c7 9d 3a 68 3b ae 1b 13 30 c2 47 2a 13 80 dd 13 f0 e4 7b c4 13 79 ec 3a 8d b1 7c e7 4b 71 d4 4e 5d a3 c2 5f ab 1e 49 ea e1 52 8f 6b 28 82 6b 09 93 08 5d 6a 25 60 c8 38 e8 87 94 a8 8f c6 d1 ec 27 3c 3d 2a f8 72 5d f7 cc 31 } //1
$a_00_1 = {44 40 08 9d eb 18 1b 19 79 4c 1b 19 f3 41 1c 18 01 b4 08 bc 53 40 63 40 14 9d 69 18 c9 18 75 4b c9 18 f9 41 09 19 c3 43 0b 43 63 40 0d 9d aa 18 d2 18 71 4b d2 18 1a 23 04 93 da 41 52 18 e3 43 13 43 4b 40 09 9d 28 18 c0 18 6c 4b c0 18 16 23 03 93 d8 41 83 18 c8 43 18 43 50 40 06 9d 2c 19 20 18 67 4c 00 19 11 24 09 94 e0 41 c4 18 d0 43 20 43 58 40 0c 9f 79 18 08 18 62 49 40 18 0b 26 f0 41 0d 96 07 19 d8 43 38 43 60 40 07 99 8a 18 10 18 5d 4a 80 18 04 99 c8 41 c2 19 e0 43 10 43 78 40 0f 99 cb 18 18 18 58 4b c0 18 03 9d e8 41 83 18 f8 43 18 43 50 40 0a 99 0c 19 20 18 54 4c 00 19 09 99 c8 41 c4 18 d0 43 20 43 58 40 12 99 cf 19 38 18 4f 4f c0 19 f0 41 07 19 d8 43 38 43 } //1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=1
}
Adware/AndroidOS/Zadmo/Adware_AndroidOS_Zadmo_B_MTB.yar
+12 -12
View File
@@ -1,13 +1,13 @@
rule Adware_AndroidOS_Zadmo_B_MTB{
meta:
description = "Adware:AndroidOS/Zadmo.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 03 00 00 "
strings :
$a_00_0 = {01 70 20 8d f8 68 71 8d f8 69 41 69 24 8d f8 6a 71 8d f8 6b 31 8d f8 6c 21 8d f8 6d b1 4f f0 2d 0b 8d f8 6e 21 8d f8 6f 61 8d f8 70 51 63 25 8d f8 71 c1 8d f8 72 31 8d f8 73 01 8d f8 74 e1 4f f0 76 0e 8d f8 88 81 4f f0 64 08 8d f8 75 41 8d f8 76 e1 8d f8 77 b1 4f f0 68 0b 8d f8 48 51 36 25 8d f8 49 b1 8d f8 4a c1 8d f8 4b 91 8d f8 4c 81 8d f8 4d 71 8d f8 4e 51 34 25 8d f8 4f 51 8d f8 50 51 79 25 8d f8 51 71 8d f8 52 31 8d f8 53 } //1
$a_00_1 = {44 5b 87 9a 36 d0 86 f8 4c b9 ea 80 fc 5e 5e 76 6a c1 40 ae e3 6a e4 70 0a f6 92 74 67 d8 73 91 b6 89 72 9c d5 e8 87 71 cc 49 09 7a ce d1 76 52 9a 73 a1 b3 15 5a 17 6b 58 7b da 54 ed 6e f4 e8 e3 3c 3b 8c 85 46 2a f8 0f f2 da c0 5a b9 } //1
$a_00_2 = {ea d8 99 b9 0c f1 9f 38 93 97 85 d9 69 90 be 9f 8f 2f 61 4b 0d 98 91 ff 28 66 46 e0 a6 b2 95 fc 5b c3 1f d7 5c 51 02 88 5e e9 3a 34 23 90 7c 6d d9 2b a2 41 b2 1b ca 9a d2 e7 e0 b5 b9 6f f0 ee d4 4b 11 3f 2c e5 35 09 29 ef 8f bd 2a d2 8e 63 b0 } //1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=1
rule Adware_AndroidOS_Zadmo_B_MTB{
meta:
description = "Adware:AndroidOS/Zadmo.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 03 00 00 "
strings :
$a_00_0 = {01 70 20 8d f8 68 71 8d f8 69 41 69 24 8d f8 6a 71 8d f8 6b 31 8d f8 6c 21 8d f8 6d b1 4f f0 2d 0b 8d f8 6e 21 8d f8 6f 61 8d f8 70 51 63 25 8d f8 71 c1 8d f8 72 31 8d f8 73 01 8d f8 74 e1 4f f0 76 0e 8d f8 88 81 4f f0 64 08 8d f8 75 41 8d f8 76 e1 8d f8 77 b1 4f f0 68 0b 8d f8 48 51 36 25 8d f8 49 b1 8d f8 4a c1 8d f8 4b 91 8d f8 4c 81 8d f8 4d 71 8d f8 4e 51 34 25 8d f8 4f 51 8d f8 50 51 79 25 8d f8 51 71 8d f8 52 31 8d f8 53 } //1
$a_00_1 = {44 5b 87 9a 36 d0 86 f8 4c b9 ea 80 fc 5e 5e 76 6a c1 40 ae e3 6a e4 70 0a f6 92 74 67 d8 73 91 b6 89 72 9c d5 e8 87 71 cc 49 09 7a ce d1 76 52 9a 73 a1 b3 15 5a 17 6b 58 7b da 54 ed 6e f4 e8 e3 3c 3b 8c 85 46 2a f8 0f f2 da c0 5a b9 } //1
$a_00_2 = {ea d8 99 b9 0c f1 9f 38 93 97 85 d9 69 90 be 9f 8f 2f 61 4b 0d 98 91 ff 28 66 46 e0 a6 b2 95 fc 5b c3 1f d7 5c 51 02 88 5e e9 3a 34 23 90 7c 6d d9 2b a2 41 b2 1b ca 9a d2 e7 e0 b5 b9 6f f0 ee d4 4b 11 3f 2c e5 35 09 29 ef 8f bd 2a d2 8e 63 b0 } //1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=1
}
Adware/AndroidOS/Zadmo/Adware_AndroidOS_Zadmo_C_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_AndroidOS_Zadmo_C_MTB{
meta:
description = "Adware:AndroidOS/Zadmo.C!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 00 "
strings :
$a_00_0 = {00 04 00 4d 45 54 41 2d 49 4e 46 2f 4d 41 4e 49 46 45 53 54 2e 4d 46 fe ca 00 00 65 8d 31 0b c2 30 10 85 f7 40 fe c3 8d 8a 24 b4 0e 56 b3 d5 ba 08 8a 83 e2 2a 67 73 c5 42 9a 94 24 43 fd f7 a6 45 50 28 b7 bd f7 be ef ce 68 db 86 42 14 77 f2 a1 75 56 41 2e 33 ce 8e 5d 6f a8 23 1b 31 a6 30 95 56 3b af c0 05 e2 ac b4 7f eb b2 c7 fa 45 90 b2 04 ee e4 66 86 de da 68 e8 4b ce ac bf 97 e3 71 76 a0 41 9c 5c 3d d5 0a 6a 83 21 50 90 9a 06 ce ae 84 86 b4 82 06 cd a8 aa 3c 61 24 2d f6 ef } //1
$a_00_1 = {41 0e d0 15 48 0e c0 15 02 46 0e cc 15 48 0e d0 15 48 0e c0 15 4d 0e c8 15 41 0e cc 15 41 0e d0 15 48 0e c0 15 43 0e c8 15 41 0e cc 15 44 0e d0 15 48 0e c0 15 47 0e c4 15 4e 0e c8 15 41 0e cc 15 42 0e d0 15 48 0e c0 15 5f 0e c4 15 41 0e c8 15 41 0e cc 15 42 0e d0 15 48 0e c0 15 43 0e c4 } //1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=1
rule Adware_AndroidOS_Zadmo_C_MTB{
meta:
description = "Adware:AndroidOS/Zadmo.C!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 00 "
strings :
$a_00_0 = {00 04 00 4d 45 54 41 2d 49 4e 46 2f 4d 41 4e 49 46 45 53 54 2e 4d 46 fe ca 00 00 65 8d 31 0b c2 30 10 85 f7 40 fe c3 8d 8a 24 b4 0e 56 b3 d5 ba 08 8a 83 e2 2a 67 73 c5 42 9a 94 24 43 fd f7 a6 45 50 28 b7 bd f7 be ef ce 68 db 86 42 14 77 f2 a1 75 56 41 2e 33 ce 8e 5d 6f a8 23 1b 31 a6 30 95 56 3b af c0 05 e2 ac b4 7f eb b2 c7 fa 45 90 b2 04 ee e4 66 86 de da 68 e8 4b ce ac bf 97 e3 71 76 a0 41 9c 5c 3d d5 0a 6a 83 21 50 90 9a 06 ce ae 84 86 b4 82 06 cd a8 aa 3c 61 24 2d f6 ef } //1
$a_00_1 = {41 0e d0 15 48 0e c0 15 02 46 0e cc 15 48 0e d0 15 48 0e c0 15 4d 0e c8 15 41 0e cc 15 41 0e d0 15 48 0e c0 15 43 0e c8 15 41 0e cc 15 44 0e d0 15 48 0e c0 15 47 0e c4 15 4e 0e c8 15 41 0e cc 15 42 0e d0 15 48 0e c0 15 5f 0e c4 15 41 0e c8 15 41 0e cc 15 42 0e d0 15 48 0e c0 15 43 0e c4 } //1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=1
}
Adware/BAT/Asedlgat/Adware_BAT_Asedlgat.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_BAT_Asedlgat{
meta:
description = "Adware:BAT/Asedlgat,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {34 40 4c 46 58 32 } //1 4@LFX2
$a_01_1 = {34 40 4c 46 58 32 53 39 } //1 4@LFX2S9
$a_01_2 = {52 65 76 69 76 61 6c 4d 46 2e 4e 65 77 2e 78 6c 73 } //1 RevivalMF.New.xls
$a_01_3 = {3a 5c 55 73 65 72 73 5c 57 69 7a 7a 6c 61 62 73 5c 50 69 63 74 75 72 65 73 5c 53 61 76 65 64 20 50 69 63 74 75 72 65 73 5c 54 72 69 63 6b 54 72 69 63 6b 5c 53 68 6f 77 4c 6f 76 65 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 52 65 76 69 76 61 6c 4d 46 2e 70 64 62 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_BAT_Asedlgat{
meta:
description = "Adware:BAT/Asedlgat,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {34 40 4c 46 58 32 } //1 4@LFX2
$a_01_1 = {34 40 4c 46 58 32 53 39 } //1 4@LFX2S9
$a_01_2 = {52 65 76 69 76 61 6c 4d 46 2e 4e 65 77 2e 78 6c 73 } //1 RevivalMF.New.xls
$a_01_3 = {3a 5c 55 73 65 72 73 5c 57 69 7a 7a 6c 61 62 73 5c 50 69 63 74 75 72 65 73 5c 53 61 76 65 64 20 50 69 63 74 75 72 65 73 5c 54 72 69 63 6b 54 72 69 63 6b 5c 53 68 6f 77 4c 6f 76 65 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 52 65 76 69 76 61 6c 4d 46 2e 70 64 62 00 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/BAT/Bawswerps/Adware_BAT_Bawswerps.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_BAT_Bawswerps{
meta:
description = "Adware:BAT/Bawswerps,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {24 61 34 61 33 61 64 33 39 2d 38 34 66 30 2d 34 33 39 38 2d 38 30 62 62 2d 30 32 61 63 32 65 61 36 32 36 65 65 } //1 $a4a3ad39-84f0-4398-80bb-02ac2ea626ee
$a_01_1 = {42 72 6f 77 73 65 72 50 6c 61 79 65 72 2e 42 72 6f 77 73 65 72 2e 72 65 73 6f 75 72 63 65 73 } //1 BrowserPlayer.Browser.resources
$a_01_2 = {42 72 6f 77 73 65 72 50 6c 61 79 65 72 2e 4d 61 69 6e 43 6c 61 73 73 2e 72 65 73 6f 75 72 63 65 73 } //1 BrowserPlayer.MainClass.resources
$a_01_3 = {42 72 6f 77 73 65 72 50 6c 61 79 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 BrowserPlayer.Properties.Resources.resources
$a_01_4 = {42 72 6f 77 73 65 72 57 65 62 } //1 BrowserWeb
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_BAT_Bawswerps{
meta:
description = "Adware:BAT/Bawswerps,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {24 61 34 61 33 61 64 33 39 2d 38 34 66 30 2d 34 33 39 38 2d 38 30 62 62 2d 30 32 61 63 32 65 61 36 32 36 65 65 } //1 $a4a3ad39-84f0-4398-80bb-02ac2ea626ee
$a_01_1 = {42 72 6f 77 73 65 72 50 6c 61 79 65 72 2e 42 72 6f 77 73 65 72 2e 72 65 73 6f 75 72 63 65 73 } //1 BrowserPlayer.Browser.resources
$a_01_2 = {42 72 6f 77 73 65 72 50 6c 61 79 65 72 2e 4d 61 69 6e 43 6c 61 73 73 2e 72 65 73 6f 75 72 63 65 73 } //1 BrowserPlayer.MainClass.resources
$a_01_3 = {42 72 6f 77 73 65 72 50 6c 61 79 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 BrowserPlayer.Properties.Resources.resources
$a_01_4 = {42 72 6f 77 73 65 72 57 65 62 } //1 BrowserWeb
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/BAT/BestOffers/Adware_BAT_BestOffers_K_MSR.yar
+12 -12
View File
@@ -1,13 +1,13 @@
rule Adware_BAT_BestOffers_K_MSR{
meta:
description = "Adware:BAT/BestOffers.K!MSR,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {74 68 65 62 65 73 74 6f 66 66 65 72 73 69 6e } //1 thebestoffersin
$a_01_1 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run
$a_01_2 = {2f 56 45 52 59 53 49 4c 45 4e 54 } //1 /VERYSILENT
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
rule Adware_BAT_BestOffers_K_MSR{
meta:
description = "Adware:BAT/BestOffers.K!MSR,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {74 68 65 62 65 73 74 6f 66 66 65 72 73 69 6e } //1 thebestoffersin
$a_01_1 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run
$a_01_2 = {2f 56 45 52 59 53 49 4c 45 4e 54 } //1 /VERYSILENT
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3
}
Adware/BAT/CsdiMonetize/Adware_BAT_CsdiMonetize_A.yar
+28 -28
View File
@@ -1,29 +1,29 @@
rule Adware_BAT_CsdiMonetize_A{
meta:
description = "Adware:BAT/CsdiMonetize.A,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {50 00 75 00 62 00 6c 00 69 00 63 00 4b 00 65 00 79 00 54 00 6f 00 6b 00 65 00 6e 00 3d 00 33 00 65 00 35 00 36 00 33 00 35 00 30 00 36 00 39 00 33 00 66 00 37 00 33 00 35 00 35 00 65 00 } //1 PublicKeyToken=3e56350693f7355e
$a_01_1 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6a 00 61 00 6d 00 65 00 73 00 2e 00 6e 00 65 00 77 00 74 00 6f 00 6e 00 6b 00 69 00 6e 00 67 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 72 00 6f 00 6a 00 65 00 63 00 74 00 73 00 2f 00 6a 00 73 00 6f 00 6e 00 } //1 http://james.newtonking.com/projects/json
$a_01_2 = {7b 00 37 00 31 00 34 00 36 00 31 00 66 00 30 00 34 00 2d 00 32 00 66 00 61 00 61 00 2d 00 34 00 62 00 62 00 39 00 2d 00 61 00 30 00 64 00 64 00 2d 00 32 00 38 00 61 00 37 00 39 00 31 00 30 00 31 00 62 00 35 00 39 00 39 00 7d 00 } //1 {71461f04-2faa-4bb9-a0dd-28a79101b599}
$a_01_3 = {24 65 61 37 38 61 65 62 34 2d 38 61 35 36 2d 34 32 37 36 2d 38 31 64 61 2d 39 38 64 35 63 63 32 37 61 35 63 34 } //1 $ea78aeb4-8a56-4276-81da-98d5cc27a5c4
$a_01_4 = {73 61 6c 65 73 5f 63 61 6d 70 61 69 67 6e 5f 74 61 72 67 65 74 5f 69 64 } //1 sales_campaign_target_id
$a_01_5 = {43 69 6e 65 6d 61 53 69 6e 73 2e 50 72 6f 70 65 72 74 69 65 73 } //1 CinemaSins.Properties
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
rule Adware_BAT_CsdiMonetize_A_2{
meta:
description = "Adware:BAT/CsdiMonetize.A,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {73 61 6c 65 73 5f 63 61 6d 70 61 69 67 6e 5f 74 61 72 67 65 74 5f 69 64 } //1 sales_campaign_target_id
$a_01_1 = {75 73 65 72 5f 73 68 6f 77 5f 63 61 70 70 69 6e 67 } //1 user_show_capping
$a_01_2 = {53 61 6e 4f 6f 2e 50 72 6f 70 65 72 74 69 65 73 } //1 SanOo.Properties
$a_01_3 = {53 61 6e 4f 6f 2e 65 78 65 } //1 SanOo.exe
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_BAT_CsdiMonetize_A{
meta:
description = "Adware:BAT/CsdiMonetize.A,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 "
strings :
$a_01_0 = {50 00 75 00 62 00 6c 00 69 00 63 00 4b 00 65 00 79 00 54 00 6f 00 6b 00 65 00 6e 00 3d 00 33 00 65 00 35 00 36 00 33 00 35 00 30 00 36 00 39 00 33 00 66 00 37 00 33 00 35 00 35 00 65 00 } //1 PublicKeyToken=3e56350693f7355e
$a_01_1 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6a 00 61 00 6d 00 65 00 73 00 2e 00 6e 00 65 00 77 00 74 00 6f 00 6e 00 6b 00 69 00 6e 00 67 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 72 00 6f 00 6a 00 65 00 63 00 74 00 73 00 2f 00 6a 00 73 00 6f 00 6e 00 } //1 http://james.newtonking.com/projects/json
$a_01_2 = {7b 00 37 00 31 00 34 00 36 00 31 00 66 00 30 00 34 00 2d 00 32 00 66 00 61 00 61 00 2d 00 34 00 62 00 62 00 39 00 2d 00 61 00 30 00 64 00 64 00 2d 00 32 00 38 00 61 00 37 00 39 00 31 00 30 00 31 00 62 00 35 00 39 00 39 00 7d 00 } //1 {71461f04-2faa-4bb9-a0dd-28a79101b599}
$a_01_3 = {24 65 61 37 38 61 65 62 34 2d 38 61 35 36 2d 34 32 37 36 2d 38 31 64 61 2d 39 38 64 35 63 63 32 37 61 35 63 34 } //1 $ea78aeb4-8a56-4276-81da-98d5cc27a5c4
$a_01_4 = {73 61 6c 65 73 5f 63 61 6d 70 61 69 67 6e 5f 74 61 72 67 65 74 5f 69 64 } //1 sales_campaign_target_id
$a_01_5 = {43 69 6e 65 6d 61 53 69 6e 73 2e 50 72 6f 70 65 72 74 69 65 73 } //1 CinemaSins.Properties
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
}
rule Adware_BAT_CsdiMonetize_A_2{
meta:
description = "Adware:BAT/CsdiMonetize.A,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 "
strings :
$a_01_0 = {73 61 6c 65 73 5f 63 61 6d 70 61 69 67 6e 5f 74 61 72 67 65 74 5f 69 64 } //1 sales_campaign_target_id
$a_01_1 = {75 73 65 72 5f 73 68 6f 77 5f 63 61 70 70 69 6e 67 } //1 user_show_capping
$a_01_2 = {53 61 6e 4f 6f 2e 50 72 6f 70 65 72 74 69 65 73 } //1 SanOo.Properties
$a_01_3 = {53 61 6e 4f 6f 2e 65 78 65 } //1 SanOo.exe
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/BAT/CsdiMonetize/Adware_BAT_CsdiMonetize_KA.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_BAT_CsdiMonetize_KA{
meta:
description = "Adware:BAT/CsdiMonetize.KA,SIGNATURE_TYPE_PEHSTR,06 00 06 00 05 00 00 "
strings :
$a_01_0 = {50 52 4f 5a 49 50 50 45 52 2e 70 64 62 } //2 PROZIPPER.pdb
$a_01_1 = {50 52 4f 5a 49 50 50 45 52 2e 67 2e 72 65 73 6f 75 72 63 65 73 } //1 PROZIPPER.g.resources
$a_01_2 = {69 59 70 78 35 54 5a 49 70 78 6a 57 44 56 45 49 6c 33 2e 6d 6b 52 36 65 4e 4f 38 66 31 75 67 37 68 6e 58 36 6c } //1 iYpx5TZIpxjWDVEIl3.mkR6eNO8f1ug7hnX6l
$a_01_3 = {61 52 33 6e 62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 } //1 aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$a_01_4 = {53 74 61 6e 64 41 6c 6f 6e 65 5f 45 6e 6b 77 79 48 6e 4c 36 61 64 64 51 53 52 49 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 StandAlone_EnkwyHnL6addQSRI.Properties.Resources.resources
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6
rule Adware_BAT_CsdiMonetize_KA{
meta:
description = "Adware:BAT/CsdiMonetize.KA,SIGNATURE_TYPE_PEHSTR,06 00 06 00 05 00 00 "
strings :
$a_01_0 = {50 52 4f 5a 49 50 50 45 52 2e 70 64 62 } //2 PROZIPPER.pdb
$a_01_1 = {50 52 4f 5a 49 50 50 45 52 2e 67 2e 72 65 73 6f 75 72 63 65 73 } //1 PROZIPPER.g.resources
$a_01_2 = {69 59 70 78 35 54 5a 49 70 78 6a 57 44 56 45 49 6c 33 2e 6d 6b 52 36 65 4e 4f 38 66 31 75 67 37 68 6e 58 36 6c } //1 iYpx5TZIpxjWDVEIl3.mkR6eNO8f1ug7hnX6l
$a_01_3 = {61 52 33 6e 62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 } //1 aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$a_01_4 = {53 74 61 6e 64 41 6c 6f 6e 65 5f 45 6e 6b 77 79 48 6e 4c 36 61 64 64 51 53 52 49 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 StandAlone_EnkwyHnL6addQSRI.Properties.Resources.resources
condition:
((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6
}
Adware/BAT/Dotdo/Adware_BAT_Dotdo_SR_MSR.yar
+10 -10
View File
@@ -1,11 +1,11 @@
rule Adware_BAT_Dotdo_SR_MSR{
meta:
description = "Adware:BAT/Dotdo.SR!MSR,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 "
strings :
$a_01_0 = {fa 25 33 00 16 00 00 01 00 00 00 11 00 00 00 02 00 00 00 03 00 00 00 02 00 00 00 11 00 00 00 0c 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 } //1
condition:
((#a_01_0 & 1)*1) >=1
rule Adware_BAT_Dotdo_SR_MSR{
meta:
description = "Adware:BAT/Dotdo.SR!MSR,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 "
strings :
$a_01_0 = {fa 25 33 00 16 00 00 01 00 00 00 11 00 00 00 02 00 00 00 03 00 00 00 02 00 00 00 11 00 00 00 0c 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 } //1
condition:
((#a_01_0 & 1)*1) >=1
}
Adware/BAT/Dotdoads/Adware_BAT_Dotdoads.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_BAT_Dotdoads{
meta:
description = "Adware:BAT/Dotdoads,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 2e 00 77 00 72 00 69 00 74 00 65 00 28 00 20 00 75 00 6e 00 65 00 73 00 63 00 61 00 70 00 65 00 28 00 20 00 27 00 25 00 33 00 43 00 25 00 37 00 33 00 25 00 36 00 33 00 25 00 37 00 32 00 25 00 36 00 39 00 25 00 37 00 30 00 25 00 37 00 34 00 25 00 32 00 30 00 25 00 36 00 43 00 25 00 36 00 31 00 25 00 36 00 45 00 25 00 36 00 37 00 25 00 37 00 35 00 25 00 36 00 31 00 25 00 36 00 37 00 25 00 36 00 35 00 25 00 33 00 44 00 25 00 32 00 37 00 25 00 34 00 41 00 25 00 36 00 31 00 25 00 37 00 36 00 25 00 36 00 31 00 25 00 35 00 33 00 25 00 36 00 33 00 25 00 37 00 32 00 25 00 36 00 39 00 25 00 37 00 30 00 25 00 37 00 34 00 25 00 32 00 37 00 25 00 32 00 30 00 } //1 document.write( unescape( '%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%27%4A%61%76%61%53%63%72%69%70%74%27%20
$a_01_1 = {25 00 36 00 38 00 25 00 37 00 34 00 25 00 37 00 34 00 25 00 37 00 30 00 25 00 33 00 41 00 25 00 32 00 46 00 25 00 32 00 46 00 25 00 36 00 31 00 25 00 36 00 31 00 25 00 32 00 45 00 25 00 36 00 34 00 25 00 36 00 46 00 25 00 37 00 34 00 25 00 36 00 34 00 25 00 36 00 46 00 25 00 32 00 45 00 25 00 36 00 45 00 25 00 36 00 35 00 25 00 37 00 34 00 25 00 32 00 46 00 25 00 36 00 31 00 25 00 36 00 34 00 25 00 37 00 33 00 25 00 37 00 33 00 } //1 %68%74%74%70%3A%2F%2F%61%61%2E%64%6F%74%64%6F%2E%6E%65%74%2F%61%64%73%73
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
rule Adware_BAT_Dotdoads{
meta:
description = "Adware:BAT/Dotdoads,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 2e 00 77 00 72 00 69 00 74 00 65 00 28 00 20 00 75 00 6e 00 65 00 73 00 63 00 61 00 70 00 65 00 28 00 20 00 27 00 25 00 33 00 43 00 25 00 37 00 33 00 25 00 36 00 33 00 25 00 37 00 32 00 25 00 36 00 39 00 25 00 37 00 30 00 25 00 37 00 34 00 25 00 32 00 30 00 25 00 36 00 43 00 25 00 36 00 31 00 25 00 36 00 45 00 25 00 36 00 37 00 25 00 37 00 35 00 25 00 36 00 31 00 25 00 36 00 37 00 25 00 36 00 35 00 25 00 33 00 44 00 25 00 32 00 37 00 25 00 34 00 41 00 25 00 36 00 31 00 25 00 37 00 36 00 25 00 36 00 31 00 25 00 35 00 33 00 25 00 36 00 33 00 25 00 37 00 32 00 25 00 36 00 39 00 25 00 37 00 30 00 25 00 37 00 34 00 25 00 32 00 37 00 25 00 32 00 30 00 } //1 document.write( unescape( '%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%27%4A%61%76%61%53%63%72%69%70%74%27%20
$a_01_1 = {25 00 36 00 38 00 25 00 37 00 34 00 25 00 37 00 34 00 25 00 37 00 30 00 25 00 33 00 41 00 25 00 32 00 46 00 25 00 32 00 46 00 25 00 36 00 31 00 25 00 36 00 31 00 25 00 32 00 45 00 25 00 36 00 34 00 25 00 36 00 46 00 25 00 37 00 34 00 25 00 36 00 34 00 25 00 36 00 46 00 25 00 32 00 45 00 25 00 36 00 45 00 25 00 36 00 35 00 25 00 37 00 34 00 25 00 32 00 46 00 25 00 36 00 31 00 25 00 36 00 34 00 25 00 37 00 33 00 25 00 37 00 33 00 } //1 %68%74%74%70%3A%2F%2F%61%61%2E%64%6F%74%64%6F%2E%6E%65%74%2F%61%64%73%73
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Adware/BAT/Fidot/Adware_BAT_Fidot.yar
+15 -15
View File
@@ -1,16 +1,16 @@
rule Adware_BAT_Fidot{
meta:
description = "Adware:BAT/Fidot,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 00 "
strings :
$a_01_0 = {02 7b 0f 00 00 0a 72 01 00 00 70 6f 12 00 00 0a 0a 02 6f 14 00 00 0a 26 02 72 2f 00 00 70 72 3f 00 00 70 6f 15 00 00 0a 26 2a } //3
$a_01_1 = {02 7b 21 00 00 0a 72 41 00 00 70 6f 2b 00 00 0a 0a 02 6f 2d 00 00 0a 26 02 72 85 01 00 70 72 95 01 00 70 6f 2e 00 00 0a 26 2a } //3
$a_01_2 = {61 00 64 00 73 00 73 00 2e 00 64 00 6f 00 74 00 64 00 6f 00 2e 00 6e 00 65 00 74 00 2f 00 61 00 64 00 73 00 73 00 2f 00 } //10 adss.dotdo.net/adss/
$a_01_3 = {36 00 31 00 25 00 36 00 34 00 25 00 37 00 33 00 25 00 37 00 33 00 25 00 32 00 45 00 } //10 61%64%73%73%2E
$a_01_4 = {53 00 74 00 61 00 72 00 74 00 69 00 6e 00 67 00 20 00 46 00 69 00 64 00 64 00 6c 00 65 00 72 00 43 00 6f 00 72 00 65 00 2e 00 2e 00 2e 00 } //1 Starting FiddlerCore...
$a_01_5 = {66 00 69 00 64 00 64 00 6c 00 65 00 72 00 2e 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 69 00 6e 00 67 00 2e 00 61 00 62 00 6f 00 72 00 74 00 69 00 66 00 63 00 6c 00 69 00 65 00 6e 00 74 00 61 00 62 00 6f 00 72 00 74 00 73 00 } //1 fiddler.network.streaming.abortifclientaborts
condition:
((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=14
rule Adware_BAT_Fidot{
meta:
description = "Adware:BAT/Fidot,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 00 "
strings :
$a_01_0 = {02 7b 0f 00 00 0a 72 01 00 00 70 6f 12 00 00 0a 0a 02 6f 14 00 00 0a 26 02 72 2f 00 00 70 72 3f 00 00 70 6f 15 00 00 0a 26 2a } //3
$a_01_1 = {02 7b 21 00 00 0a 72 41 00 00 70 6f 2b 00 00 0a 0a 02 6f 2d 00 00 0a 26 02 72 85 01 00 70 72 95 01 00 70 6f 2e 00 00 0a 26 2a } //3
$a_01_2 = {61 00 64 00 73 00 73 00 2e 00 64 00 6f 00 74 00 64 00 6f 00 2e 00 6e 00 65 00 74 00 2f 00 61 00 64 00 73 00 73 00 2f 00 } //10 adss.dotdo.net/adss/
$a_01_3 = {36 00 31 00 25 00 36 00 34 00 25 00 37 00 33 00 25 00 37 00 33 00 25 00 32 00 45 00 } //10 61%64%73%73%2E
$a_01_4 = {53 00 74 00 61 00 72 00 74 00 69 00 6e 00 67 00 20 00 46 00 69 00 64 00 64 00 6c 00 65 00 72 00 43 00 6f 00 72 00 65 00 2e 00 2e 00 2e 00 } //1 Starting FiddlerCore...
$a_01_5 = {66 00 69 00 64 00 64 00 6c 00 65 00 72 00 2e 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 69 00 6e 00 67 00 2e 00 61 00 62 00 6f 00 72 00 74 00 69 00 66 00 63 00 6c 00 69 00 65 00 6e 00 74 00 61 00 62 00 6f 00 72 00 74 00 73 00 } //1 fiddler.network.streaming.abortifclientaborts
condition:
((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=14
}
Adware/BAT/Tracker/Adware_BAT_Tracker_A.yar
+14 -14
View File
@@ -1,15 +1,15 @@
rule Adware_BAT_Tracker_A{
meta:
description = "Adware:BAT/Tracker.A,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {62 75 79 69 6e 67 5f 74 72 61 63 6b 5f 69 64 } //1 buying_track_id
$a_01_1 = {73 61 6c 65 73 5f 74 72 61 63 6b 5f 69 64 } //1 sales_track_id
$a_01_2 = {73 61 6c 65 73 5f 63 61 6d 70 61 69 67 6e 5f 74 61 72 67 65 74 5f 69 64 } //1 sales_campaign_target_id
$a_01_3 = {41 00 6e 00 61 00 6c 00 79 00 73 00 69 00 73 00 44 00 61 00 74 00 61 00 2e 00 65 00 78 00 65 00 } //1 AnalysisData.exe
$a_01_4 = {61 00 73 00 70 00 6e 00 65 00 74 00 5f 00 77 00 70 00 2e 00 65 00 78 00 65 00 } //1 aspnet_wp.exe
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
rule Adware_BAT_Tracker_A{
meta:
description = "Adware:BAT/Tracker.A,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 "
strings :
$a_01_0 = {62 75 79 69 6e 67 5f 74 72 61 63 6b 5f 69 64 } //1 buying_track_id
$a_01_1 = {73 61 6c 65 73 5f 74 72 61 63 6b 5f 69 64 } //1 sales_track_id
$a_01_2 = {73 61 6c 65 73 5f 63 61 6d 70 61 69 67 6e 5f 74 61 72 67 65 74 5f 69 64 } //1 sales_campaign_target_id
$a_01_3 = {41 00 6e 00 61 00 6c 00 79 00 73 00 69 00 73 00 44 00 61 00 74 00 61 00 2e 00 65 00 78 00 65 00 } //1 AnalysisData.exe
$a_01_4 = {61 00 73 00 70 00 6e 00 65 00 74 00 5f 00 77 00 70 00 2e 00 65 00 78 00 65 00 } //1 aspnet_wp.exe
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5
}
Adware/BAT/Wareda/Adware_BAT_Wareda_RS_MTB.yar
+18 -18
View File
@@ -1,19 +1,19 @@
rule Adware_BAT_Wareda_RS_MTB{
meta:
description = "Adware:BAT/Wareda.RS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 00 "
strings :
$a_80_0 = {35 34 2e 31 36 34 2e 31 34 34 2e 32 35 32 3a 31 30 30 30 30 } //54.164.144.252:10000 5
$a_80_1 = {67 65 74 4f 66 66 65 72 73 2e 70 68 70 } //getOffers.php 1
$a_80_2 = {72 75 6e 5f 6f 66 66 65 72 } //run_offer 1
$a_80_3 = {4c 69 73 74 4f 66 66 65 72 73 2e 70 68 70 } //ListOffers.php 1
$a_80_4 = {4d 6f 64 65 6c 4e 61 6d 65 } //ModelName 1
$a_80_5 = {50 43 4d 6f 64 65 6c } //PCModel 1
$a_80_6 = {61 70 70 43 61 6c 63 75 6c 61 74 6f 72 } //appCalculator 1
$a_80_7 = {61 70 70 43 61 6c 65 6e 64 61 72 } //appCalendar 1
$a_80_8 = {61 70 70 43 68 65 73 73 } //appChess 1
condition:
((#a_80_0 & 1)*5+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=10
rule Adware_BAT_Wareda_RS_MTB{
meta:
description = "Adware:BAT/Wareda.RS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 00 "
strings :
$a_80_0 = {35 34 2e 31 36 34 2e 31 34 34 2e 32 35 32 3a 31 30 30 30 30 } //54.164.144.252:10000 5
$a_80_1 = {67 65 74 4f 66 66 65 72 73 2e 70 68 70 } //getOffers.php 1
$a_80_2 = {72 75 6e 5f 6f 66 66 65 72 } //run_offer 1
$a_80_3 = {4c 69 73 74 4f 66 66 65 72 73 2e 70 68 70 } //ListOffers.php 1
$a_80_4 = {4d 6f 64 65 6c 4e 61 6d 65 } //ModelName 1
$a_80_5 = {50 43 4d 6f 64 65 6c } //PCModel 1
$a_80_6 = {61 70 70 43 61 6c 63 75 6c 61 74 6f 72 } //appCalculator 1
$a_80_7 = {61 70 70 43 61 6c 65 6e 64 61 72 } //appCalendar 1
$a_80_8 = {61 70 70 43 68 65 73 73 } //appChess 1
condition:
((#a_80_0 & 1)*5+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=10
}
Adware/MacOS/Adload/Adware_MacOS_AdLoad_B_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_MacOS_AdLoad_B_MTB{
meta:
description = "Adware:MacOS/AdLoad.B!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_03_0 = {48 83 f9 04 0f 82 ?? ?? 00 00 48 89 c2 8b 00 8b 74 0a fc c1 e0 03 48 01 c8 48 31 f0 48 ba 69 2d 38 eb 08 ea df 9d 48 89 d7 48 0f af c2 48 89 c2 48 c1 ea 2f 48 31 f0 } //1
$a_03_1 = {44 8b 68 04 48 89 df ?? ?? ?? 02 00 48 85 c0 74 dc 8a 18 84 db 74 d6 41 83 c5 07 41 83 e5 f8 4c 89 f9 4c 29 e9 48 c1 e9 03 31 d2 } //1
$a_01_2 = {75 75 69 64 5f 67 65 6e 65 72 61 74 65 5f 72 61 6e 64 6f 6d } //1 uuid_generate_random
$a_01_3 = {6b 65 79 45 6e 75 6d 65 72 61 74 6f 72 } //1 keyEnumerator
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_MacOS_AdLoad_B_MTB{
meta:
description = "Adware:MacOS/AdLoad.B!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_03_0 = {48 83 f9 04 0f 82 ?? ?? 00 00 48 89 c2 8b 00 8b 74 0a fc c1 e0 03 48 01 c8 48 31 f0 48 ba 69 2d 38 eb 08 ea df 9d 48 89 d7 48 0f af c2 48 89 c2 48 c1 ea 2f 48 31 f0 } //1
$a_03_1 = {44 8b 68 04 48 89 df ?? ?? ?? 02 00 48 85 c0 74 dc 8a 18 84 db 74 d6 41 83 c5 07 41 83 e5 f8 4c 89 f9 4c 29 e9 48 c1 e9 03 31 d2 } //1
$a_01_2 = {75 75 69 64 5f 67 65 6e 65 72 61 74 65 5f 72 61 6e 64 6f 6d } //1 uuid_generate_random
$a_01_3 = {6b 65 79 45 6e 75 6d 65 72 61 74 6f 72 } //1 keyEnumerator
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/MacOS/Adload/Adware_MacOS_Adload_AA_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_MacOS_Adload_AA_MTB{
meta:
description = "Adware:MacOS/Adload.AA!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_00_0 = {48 8b 00 48 89 45 d0 31 c0 48 89 47 10 48 89 47 08 48 89 bd 18 fe ff ff 48 89 07 48 89 85 00 ff ff ff 66 0f 57 c0 66 0f 29 85 f0 fe ff ff 48 89 85 30 ff ff ff 48 89 85 60 ff ff ff 88 85 70 ff ff ff 48 89 45 a8 48 89 45 a0 48 89 45 98 88 85 28 ff ff ff 48 89 85 20 ff ff ff 66 0f 29 85 10 ff ff ff 88 45 90 48 89 45 88 48 89 45 80 48 89 85 78 ff ff ff 88 45 c0 48 89 85 60 fe ff ff 66 0f 29 85 50 fe ff ff 48 8d 35 a7 e9 00 00 48 8d bd 30 bd ff ff ba 22 00 00 00 } //2
$a_00_1 = {4c 8b ad d0 fe ff ff 4c 39 ad d8 fe ff ff 0f 84 84 09 00 00 48 8d 3d 59 b6 00 00 ba 07 00 00 00 4c 89 ee e8 bc ac 00 00 85 c0 0f 85 79 09 00 00 49 8d 75 10 49 63 45 08 49 8d 54 05 10 48 8d bd b0 fe ff ff e8 f1 51 00 00 48 8b 8d b0 fe ff ff 48 8b b5 b8 fe ff ff 48 39 ce 74 41 48 63 85 88 fe ff ff 48 69 d0 d3 4d 62 10 48 89 d6 48 c1 ee 3f 48 c1 ea 23 01 f2 6b d2 7d 29 d0 31 d2 30 04 11 } //2
$a_01_2 = {75 75 69 64 5f 67 65 6e 65 72 61 74 65 5f 72 61 6e 64 6f 6d } //1 uuid_generate_random
$a_01_3 = {6b 65 79 65 6e 75 6d 65 72 61 74 6f 72 } //1 keyenumerator
condition:
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
rule Adware_MacOS_Adload_AA_MTB{
meta:
description = "Adware:MacOS/Adload.AA!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_00_0 = {48 8b 00 48 89 45 d0 31 c0 48 89 47 10 48 89 47 08 48 89 bd 18 fe ff ff 48 89 07 48 89 85 00 ff ff ff 66 0f 57 c0 66 0f 29 85 f0 fe ff ff 48 89 85 30 ff ff ff 48 89 85 60 ff ff ff 88 85 70 ff ff ff 48 89 45 a8 48 89 45 a0 48 89 45 98 88 85 28 ff ff ff 48 89 85 20 ff ff ff 66 0f 29 85 10 ff ff ff 88 45 90 48 89 45 88 48 89 45 80 48 89 85 78 ff ff ff 88 45 c0 48 89 85 60 fe ff ff 66 0f 29 85 50 fe ff ff 48 8d 35 a7 e9 00 00 48 8d bd 30 bd ff ff ba 22 00 00 00 } //2
$a_00_1 = {4c 8b ad d0 fe ff ff 4c 39 ad d8 fe ff ff 0f 84 84 09 00 00 48 8d 3d 59 b6 00 00 ba 07 00 00 00 4c 89 ee e8 bc ac 00 00 85 c0 0f 85 79 09 00 00 49 8d 75 10 49 63 45 08 49 8d 54 05 10 48 8d bd b0 fe ff ff e8 f1 51 00 00 48 8b 8d b0 fe ff ff 48 8b b5 b8 fe ff ff 48 39 ce 74 41 48 63 85 88 fe ff ff 48 69 d0 d3 4d 62 10 48 89 d6 48 c1 ee 3f 48 c1 ea 23 01 f2 6b d2 7d 29 d0 31 d2 30 04 11 } //2
$a_01_2 = {75 75 69 64 5f 67 65 6e 65 72 61 74 65 5f 72 61 6e 64 6f 6d } //1 uuid_generate_random
$a_01_3 = {6b 65 79 65 6e 75 6d 65 72 61 74 6f 72 } //1 keyenumerator
condition:
((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
}
Adware/MacOS/Adload/Adware_MacOS_Adload_AC_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_MacOS_Adload_AC_MTB{
meta:
description = "Adware:MacOS/Adload.AC!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {55 48 89 e5 48 8b 77 08 8b 57 10 48 8b 3f e8 db 30 21 00 85 c0 7d 09 e8 cc 30 21 00 8b 00 f7 d8 } //1
$a_01_1 = {55 48 89 e5 48 89 fb 48 8b 3b 48 8b 73 08 8b 53 10 8b 4b 14 44 8b 43 18 44 8b 4b 1c e8 af 2d 21 00 31 d2 48 83 f8 ff 75 0a e8 5a 2d 21 00 48 63 10 31 c0 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
rule Adware_MacOS_Adload_AC_MTB{
meta:
description = "Adware:MacOS/Adload.AC!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {55 48 89 e5 48 8b 77 08 8b 57 10 48 8b 3f e8 db 30 21 00 85 c0 7d 09 e8 cc 30 21 00 8b 00 f7 d8 } //1
$a_01_1 = {55 48 89 e5 48 89 fb 48 8b 3b 48 8b 73 08 8b 53 10 8b 4b 14 44 8b 43 18 44 8b 4b 1c e8 af 2d 21 00 31 d2 48 83 f8 ff 75 0a e8 5a 2d 21 00 48 63 10 31 c0 } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Adware/MacOS/Adload/Adware_MacOS_Adload_AK_MTB.yar
+13 -13
View File
@@ -1,14 +1,14 @@
rule Adware_MacOS_Adload_AK_MTB{
meta:
description = "Adware:MacOS/Adload.AK!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_00_0 = {64 65 6c 65 67 61 74 65 63 35 73 68 6f 77 6e 73 62 76 70 77 76 64 } //1 delegatec5shownsbvpwvd
$a_00_1 = {67 65 74 53 74 61 74 65 4f 66 53 61 66 61 72 69 45 78 74 65 6e 73 69 6f 6e 57 69 74 68 49 64 65 6e 74 69 66 69 65 72 } //1 getStateOfSafariExtensionWithIdentifier
$a_00_2 = {44 65 6c 65 67 61 74 65 43 35 63 68 65 63 6b 79 79 46 5a 79 79 } //1 DelegateC5checkyyFZyy
$a_00_3 = {73 68 61 72 65 64 55 73 65 72 44 65 66 61 75 6c 74 73 } //1 sharedUserDefaults
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4
rule Adware_MacOS_Adload_AK_MTB{
meta:
description = "Adware:MacOS/Adload.AK!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 00 "
strings :
$a_00_0 = {64 65 6c 65 67 61 74 65 63 35 73 68 6f 77 6e 73 62 76 70 77 76 64 } //1 delegatec5shownsbvpwvd
$a_00_1 = {67 65 74 53 74 61 74 65 4f 66 53 61 66 61 72 69 45 78 74 65 6e 73 69 6f 6e 57 69 74 68 49 64 65 6e 74 69 66 69 65 72 } //1 getStateOfSafariExtensionWithIdentifier
$a_00_2 = {44 65 6c 65 67 61 74 65 43 35 63 68 65 63 6b 79 79 46 5a 79 79 } //1 DelegateC5checkyyFZyy
$a_00_3 = {73 68 61 72 65 64 55 73 65 72 44 65 66 61 75 6c 74 73 } //1 sharedUserDefaults
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4
}
Adware/MacOS/Adload/Adware_MacOS_Adload_A_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_MacOS_Adload_A_MTB{
meta:
description = "Adware:MacOS/Adload.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 02 00 00 "
strings :
$a_01_0 = {63 00 d7 1d 0b e6 66 00 91 1e 0c c1 63 00 ee 1f 80 03 dc 66 00 86 23 0b bc 66 00 d5 23 1e fb 65 00 f3 23 0b f9 65 00 c2 24 08 d4 66 00 d2 24 08 d2 66 00 f6 24 08 b7 63 00 a7 25 2c 92 64 00 d8 25 13 8d 64 00 eb 25 13 ee 63 00 ca 28 0c d4 66 00 dd 28 08 f4 62 } //1
$a_01_1 = {da 01 35 bd 01 c6 01 66 6a 6a 2e 3e 3d af 02 96 05 4d 91 03 88 02 3e 1e 3e aa 01 0a 1c 84 02 94 02 fc 01 c0 01 ac 04 a6 05 48 91 05 31 26 2c 36 26 26 2c 9e 01 30 38 e2 02 26 42 5a fe 02 7e 86 01 7a 82 01 84 01 8c 01 20 0e 0e 26 2c 26 2c 0a 1c 0e 0e 4e 56 58 60 ba 04 a2 04 6e 76 76 7e 4e 72 50 48 2a } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1
rule Adware_MacOS_Adload_A_MTB{
meta:
description = "Adware:MacOS/Adload.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 02 00 00 "
strings :
$a_01_0 = {63 00 d7 1d 0b e6 66 00 91 1e 0c c1 63 00 ee 1f 80 03 dc 66 00 86 23 0b bc 66 00 d5 23 1e fb 65 00 f3 23 0b f9 65 00 c2 24 08 d4 66 00 d2 24 08 d2 66 00 f6 24 08 b7 63 00 a7 25 2c 92 64 00 d8 25 13 8d 64 00 eb 25 13 ee 63 00 ca 28 0c d4 66 00 dd 28 08 f4 62 } //1
$a_01_1 = {da 01 35 bd 01 c6 01 66 6a 6a 2e 3e 3d af 02 96 05 4d 91 03 88 02 3e 1e 3e aa 01 0a 1c 84 02 94 02 fc 01 c0 01 ac 04 a6 05 48 91 05 31 26 2c 36 26 26 2c 9e 01 30 38 e2 02 26 42 5a fe 02 7e 86 01 7a 82 01 84 01 8c 01 20 0e 0e 26 2c 26 2c 0a 1c 0e 0e 4e 56 58 60 ba 04 a2 04 6e 76 76 7e 4e 72 50 48 2a } //1
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1
}
Adware/MacOS/Adload/Adware_MacOS_Adload_C_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_MacOS_Adload_C_MTB{
meta:
description = "Adware:MacOS/Adload.C!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {4b 65 79 38 69 73 55 6e 69 71 75 65 79 71 5f 6e 5f 78 53 62 74 46 53 53 5f 79 70 54 67 35 54 66 34 6e 78 6e 6e 5f 6e 00 5f 24 73 53 44 79 71 5f 53 67 78 63 69 73 53 53 5f 79 70 54 67 35 54 66 34 6e 67 58 6e 5f 6e 00 5f } //1
$a_01_1 = {73 68 61 72 65 64 55 73 65 72 44 65 66 61 75 6c 74 73 } //1 sharedUserDefaults
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
rule Adware_MacOS_Adload_C_MTB{
meta:
description = "Adware:MacOS/Adload.C!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {4b 65 79 38 69 73 55 6e 69 71 75 65 79 71 5f 6e 5f 78 53 62 74 46 53 53 5f 79 70 54 67 35 54 66 34 6e 78 6e 6e 5f 6e 00 5f 24 73 53 44 79 71 5f 53 67 78 63 69 73 53 53 5f 79 70 54 67 35 54 66 34 6e 67 58 6e 5f 6e 00 5f } //1
$a_01_1 = {73 68 61 72 65 64 55 73 65 72 44 65 66 61 75 6c 74 73 } //1 sharedUserDefaults
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
}
Adware/MacOS/Adload/Adware_MacOS_Adload_D_MTB.yar
+10 -10
View File
@@ -1,11 +1,11 @@
rule Adware_MacOS_Adload_D_MTB{
meta:
description = "Adware:MacOS/Adload.D!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_00_0 = {00 00 8e 0a 06 e0 23 00 9d 0b 0c ef 22 00 ad 0b 0f ea 22 00 da 0b 34 ab 23 00 8e 0c 82 02 00 00 90 0e 0c b2 22 00 b9 0f 05 b0 22 00 b2 11 f0 01 9a 23 00 dd 13 09 e8 22 00 eb 13 09 e3 22 00 8d 14 30 f1 22 00 95 16 a5 01 9a 23 00 de 17 0a ab 22 00 f2 17 13 93 22 00 85 18 ed 01 00 00 f2 19 05 b4 22 00 90 1b 20 9a 23 00 ce 21 05 8e 22 00 d5 } //1
condition:
((#a_00_0 & 1)*1) >=1
rule Adware_MacOS_Adload_D_MTB{
meta:
description = "Adware:MacOS/Adload.D!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_00_0 = {00 00 8e 0a 06 e0 23 00 9d 0b 0c ef 22 00 ad 0b 0f ea 22 00 da 0b 34 ab 23 00 8e 0c 82 02 00 00 90 0e 0c b2 22 00 b9 0f 05 b0 22 00 b2 11 f0 01 9a 23 00 dd 13 09 e8 22 00 eb 13 09 e3 22 00 8d 14 30 f1 22 00 95 16 a5 01 9a 23 00 de 17 0a ab 22 00 f2 17 13 93 22 00 85 18 ed 01 00 00 f2 19 05 b4 22 00 90 1b 20 9a 23 00 ce 21 05 8e 22 00 d5 } //1
condition:
((#a_00_0 & 1)*1) >=1
}
Adware/MacOS/Adload/Adware_MacOS_Adload_E_MTB.yar
+10 -10
View File
@@ -1,11 +1,11 @@
rule Adware_MacOS_Adload_E_MTB{
meta:
description = "Adware:MacOS/Adload.E!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_00_0 = {d1 28 05 b2 11 19 c5 28 05 f1 11 08 ef 2c 05 89 13 1d a6 31 03 a6 13 40 da 32 03 e6 13 0f 8f 2e 03 fe 13 0c f7 2d 03 90 14 0f e2 2d 03 9f 14 26 ca 2d 03 c8 14 0f b6 2d 03 a9 15 16 c3 31 03 bf 15 16 f0 30 03 e5 15 13 ab 31 03 89 16 13 93 2f 03 a7 16 16 e7 2b 03 92 17 0f af 32 03 a1 17 31 } //1
condition:
((#a_00_0 & 1)*1) >=1
rule Adware_MacOS_Adload_E_MTB{
meta:
description = "Adware:MacOS/Adload.E!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_00_0 = {d1 28 05 b2 11 19 c5 28 05 f1 11 08 ef 2c 05 89 13 1d a6 31 03 a6 13 40 da 32 03 e6 13 0f 8f 2e 03 fe 13 0c f7 2d 03 90 14 0f e2 2d 03 9f 14 26 ca 2d 03 c8 14 0f b6 2d 03 a9 15 16 c3 31 03 bf 15 16 f0 30 03 e5 15 13 ab 31 03 89 16 13 93 2f 03 a7 16 16 e7 2b 03 92 17 0f af 32 03 a1 17 31 } //1
condition:
((#a_00_0 & 1)*1) >=1
}
Adware/MacOS/Adload/Adware_MacOS_Adload_F_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_MacOS_Adload_F_MTB{
meta:
description = "Adware:MacOS/Adload.F!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {48 89 c1 48 c1 e1 08 8b 85 58 fc ff ff 48 09 c8 49 c1 e7 10 49 09 c7 89 d8 48 c1 e0 18 4c 09 f8 48 3d 50 4b 03 04 41 bc 99 ff ff ff b8 00 00 00 00 44 0f 44 e0 } //1
$a_03_1 = {4c 8b b5 c0 fc ff ff 4c 29 f3 48 89 d8 48 ff c0 0f 88 ?? ?? ?? ?? 49 bd ff ff ff ff ff ff ff 7f 48 b9 ff ff ff ff ff ff ff 3f 48 39 cb 73 ?? 4c 8d 2c 1b 49 39 c5 4c 0f 42 e8 4d 85 ed } //1
condition:
((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2
rule Adware_MacOS_Adload_F_MTB{
meta:
description = "Adware:MacOS/Adload.F!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_01_0 = {48 89 c1 48 c1 e1 08 8b 85 58 fc ff ff 48 09 c8 49 c1 e7 10 49 09 c7 89 d8 48 c1 e0 18 4c 09 f8 48 3d 50 4b 03 04 41 bc 99 ff ff ff b8 00 00 00 00 44 0f 44 e0 } //1
$a_03_1 = {4c 8b b5 c0 fc ff ff 4c 29 f3 48 89 d8 48 ff c0 0f 88 ?? ?? ?? ?? 49 bd ff ff ff ff ff ff ff 7f 48 b9 ff ff ff ff ff ff ff 3f 48 39 cb 73 ?? 4c 8d 2c 1b 49 39 c5 4c 0f 42 e8 4d 85 ed } //1
condition:
((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2
}
Adware/MacOS/Adload/Adware_MacOS_Adload_G_MTB.yar
+12 -12
View File
@@ -1,13 +1,13 @@
rule Adware_MacOS_Adload_G_MTB{
meta:
description = "Adware:MacOS/Adload.G!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {49 63 c7 42 8a 04 28 42 32 44 35 c0 8b 4d a8 88 45 a8 4c 89 e7 48 8d 75 a8 e8 6e be ff ff 8b 45 a8 45 85 ff } //1
$a_01_1 = {8a 4b 10 88 08 48 83 c3 08 48 ff c0 48 8b 1b 49 39 df } //1
$a_03_2 = {b8 ff ff ff ff 83 fe 10 75 ?? 40 80 cf 20 89 f9 80 c1 9f 80 f9 05 77 ?? 40 0f b6 c7 83 c0 a9 } //2
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*2) >=3
rule Adware_MacOS_Adload_G_MTB{
meta:
description = "Adware:MacOS/Adload.G!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 00 "
strings :
$a_01_0 = {49 63 c7 42 8a 04 28 42 32 44 35 c0 8b 4d a8 88 45 a8 4c 89 e7 48 8d 75 a8 e8 6e be ff ff 8b 45 a8 45 85 ff } //1
$a_01_1 = {8a 4b 10 88 08 48 83 c3 08 48 ff c0 48 8b 1b 49 39 df } //1
$a_03_2 = {b8 ff ff ff ff 83 fe 10 75 ?? 40 80 cf 20 89 f9 80 c1 9f 80 f9 05 77 ?? 40 0f b6 c7 83 c0 a9 } //2
condition:
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*2) >=3
}
Adware/MacOS/Adload/Adware_MacOS_Adload_H_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_MacOS_Adload_H_MTB{
meta:
description = "Adware:MacOS/Adload.H!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_00_0 = {41 bf 01 00 00 00 45 31 f6 49 c1 e6 04 48 8b 45 80 4a 8b 3c 30 48 89 de e8 36 7d 03 00 85 c0 74 0d 45 89 fe 41 ff c7 4d 39 ee 72 dd eb 14 48 8b 45 80 4a 8b 44 30 08 48 8b 8d 68 ff ff ff 4a 89 04 e1 } //1
$a_00_1 = {49 89 d6 49 89 ff e8 d8 79 03 00 48 89 c7 4c 89 e6 e8 4d 78 03 00 48 85 c0 74 13 48 89 c3 4c 89 ff 48 89 c6 4c 89 f2 e8 c3 79 03 00 eb 02 31 db 48 89 d8 } //1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2
rule Adware_MacOS_Adload_H_MTB{
meta:
description = "Adware:MacOS/Adload.H!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_00_0 = {41 bf 01 00 00 00 45 31 f6 49 c1 e6 04 48 8b 45 80 4a 8b 3c 30 48 89 de e8 36 7d 03 00 85 c0 74 0d 45 89 fe 41 ff c7 4d 39 ee 72 dd eb 14 48 8b 45 80 4a 8b 44 30 08 48 8b 8d 68 ff ff ff 4a 89 04 e1 } //1
$a_00_1 = {49 89 d6 49 89 ff e8 d8 79 03 00 48 89 c7 4c 89 e6 e8 4d 78 03 00 48 85 c0 74 13 48 89 c3 4c 89 ff 48 89 c6 4c 89 f2 e8 c3 79 03 00 eb 02 31 db 48 89 d8 } //1
condition:
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2
}
Adware/MacOS/Adload/Adware_MacOS_Adload_I_MTB.yar
+11 -11
View File
@@ -1,12 +1,12 @@
rule Adware_MacOS_Adload_I_MTB{
meta:
description = "Adware:MacOS/Adload.I!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_03_0 = {41 55 41 54 53 48 83 ec 48 49 89 d7 49 39 d0 74 ?? 48 89 ca 48 29 f2 48 c1 e2 05 4c 89 c0 48 2b 01 48 c1 f8 04 48 01 d0 4c 89 f9 48 2b 0e 48 c1 f9 04 48 29 c8 } //1
$a_03_1 = {48 8b 4f 08 4c 8b 4f 10 4d 89 ce 49 29 ce 4c 89 f3 48 c1 e3 05 48 ff cb 4d 85 f6 49 0f 44 de 48 8b 57 20 48 89 7d b0 48 8b 7f 28 48 01 d7 48 29 fb 48 29 d8 4c 89 45 a0 0f ?? ?? ?? ?? ?? 48 89 75 ?? 31 ff 49 39 c9 40 0f 94 c7 48 01 f8 48 89 c7 48 c1 ef 08 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2
rule Adware_MacOS_Adload_I_MTB{
meta:
description = "Adware:MacOS/Adload.I!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 "
strings :
$a_03_0 = {41 55 41 54 53 48 83 ec 48 49 89 d7 49 39 d0 74 ?? 48 89 ca 48 29 f2 48 c1 e2 05 4c 89 c0 48 2b 01 48 c1 f8 04 48 01 d0 4c 89 f9 48 2b 0e 48 c1 f9 04 48 29 c8 } //1
$a_03_1 = {48 8b 4f 08 4c 8b 4f 10 4d 89 ce 49 29 ce 4c 89 f3 48 c1 e3 05 48 ff cb 4d 85 f6 49 0f 44 de 48 8b 57 20 48 89 7d b0 48 8b 7f 28 48 01 d7 48 29 fb 48 29 d8 4c 89 45 a0 0f ?? ?? ?? ?? ?? 48 89 75 ?? 31 ff 49 39 c9 40 0f 94 c7 48 01 f8 48 89 c7 48 c1 ef 08 } //1
condition:
((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2
}

Some files were not shown because too many files have changed in this diff Show More