mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
13 lines
704 B
Plaintext
13 lines
704 B
Plaintext
|
|
rule Exploit_Win32_Kitrap_A{
|
|
meta:
|
|
description = "Exploit:Win32/Kitrap.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 "
|
|
|
|
strings :
|
|
$a_02_0 = {68 00 80 00 00 8d 45 ec 50 8d 4d f4 51 ff 15 ?? ?? ?? ?? 50 ff 55 f8 c7 45 f4 01 00 00 00 c7 45 ec 00 00 10 00 6a 40 68 00 30 00 00 } //1
|
|
$a_01_1 = {4e 74 56 64 6d 43 6f 6e 74 72 6f 6c } //1 NtVdmControl
|
|
$a_02_2 = {c7 85 e4 ed ff ff 0b 00 00 00 8d 8d 50 da ff ff 89 8d c8 ed ff ff 6a 00 6a 00 8d 95 e4 d9 ff ff 52 e8 ?? ?? ?? ?? 83 c4 0c 8b f0 6a 00 6a 00 8d 85 24 da ff ff 50 e8 ?? ?? ?? ?? 83 c4 0c 03 f0 89 b5 e0 ed ff ff c7 85 e8 ed ff ff 00 01 00 00 } //1
|
|
condition:
|
|
((#a_02_0 & 1)*1+(#a_01_1 & 1)*1+(#a_02_2 & 1)*1) >=3
|
|
|
|
} |