mirror of
https://github.com/valitydev/signature-base.git
synced 2024-11-06 18:15:20 +00:00
15 lines
450 B
Plaintext
15 lines
450 B
Plaintext
|
|
rule Scarcruft_malware_Feb18_1 {
|
|
meta:
|
|
description = "Detects Scarcruft malware - February 2018"
|
|
author = "Florian rootpath"
|
|
reference = "https://twitter.com/craiu/status/959477129795731458"
|
|
date = "2018-02-03"
|
|
score = 90
|
|
strings:
|
|
$x1 = "d:\\HighSchool\\version 13\\2ndBD\\T+M\\" ascii
|
|
$x2 = "cmd.exe /C ping 0.1.1.2" wide
|
|
condition:
|
|
uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
|
|
}
|