roadwy-DefenderYara/Exploit/WinNT/SuspJavaExploit/Exploit_WinNT_SuspJavaExploit_E.yar

rule Exploit_WinNT_SuspJavaExploit_E{
	meta:
		description = "Exploit:WinNT/SuspJavaExploit.E,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 00 "
		
	strings :
		$a_00_0 = {68 74 74 70 3a 2f 2f 31 35 39 2e 38 39 2e 34 2e 33 39 } //1 http://159.89.4.39
		$a_00_1 = {63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 78 38 36 } //1 chmod 777 /tmp/x86
		$a_00_2 = {2e 2f 74 6d 70 2f 78 38 36 } //1 ./tmp/x86
	condition:
		((#a_00_0  & 1)*1+(#a_00_1  & 1)*1+(#a_00_2  & 1)*1) >=3
 
}