Skip to content

R
rules
Commit 3dddf413 by Marc Rivero López Committed by GitHub
Options

Update APT_Derusbi.yar 

Fixed style and space
parent cce235cc
Showing with 253 additions and 229 deletions
malware/APT_Derusbi.yar
...@@ -3,183 +3,186 @@ ...@@ -3,183 +3,186 @@
*/ */
import "pe" rule apt_nix_elf_derusbi
rule apt_nix_elf_derusbi : APT Derusbi ELF
{ {
meta:
meta:
Author = "@seifreed" Author = "@seifreed"
strings:
$ = "LxMain" strings:
$ = "execve" $ = "LxMain"
$ = "kill" $ = "execve"
$ = "cp -a %s %s" $ = "kill"
$ = "%s &" $ = "cp -a %s %s"
$ = "dbus-daemon" $ = "%s &"
$ = "--noprofile" $ = "dbus-daemon"
$ = "--norc" $ = "--noprofile"
$ = "TERM=vt100" $ = "--norc"
$ = "/proc/%u/cmdline" $ = "TERM=vt100"
$ = "loadso" $ = "/proc/%u/cmdline"
$ = "/proc/self/exe" $ = "loadso"
$ = "Proxy-Connection: Keep-Alive" $ = "/proc/self/exe"
$ = "Connection: Keep-Alive" $ = "Proxy-Connection: Keep-Alive"
$ = "CONNECT %s" $ = "Connection: Keep-Alive"
$ = "HOST: %s:%d" $ = "CONNECT %s"
$ = "User-Agent: Mozilla/4.0" $ = "HOST: %s:%d"
$ = "Proxy-Authorization: Basic %s" $ = "User-Agent: Mozilla/4.0"
$ = "Server: Apache" $ = "Proxy-Authorization: Basic %s"
$ = "Proxy-Authenticate" $ = "Server: Apache"
$ = "gettimeofday" $ = "Proxy-Authenticate"
$ = "pthread_create" $ = "gettimeofday"
$ = "pthread_join" $ = "pthread_create"
$ = "pthread_mutex_init" $ = "pthread_join"
$ = "pthread_mutex_destroy" $ = "pthread_mutex_init"
$ = "pthread_mutex_lock" $ = "pthread_mutex_destroy"
$ = "getsockopt" $ = "pthread_mutex_lock"
$ = "socket" $ = "getsockopt"
$ = "setsockopt" $ = "socket"
$ = "select" $ = "setsockopt"
$ = "bind" $ = "select"
$ = "shutdown" $ = "bind"
$ = "listen" $ = "shutdown"
$ = "opendir" $ = "listen"
$ = "readdir" $ = "opendir"
$ = "closedir" $ = "readdir"
$ = "rename" $ = "closedir"
$ = "rename"
condition:
(uint32(0) == 0x4464c457f) and (all of them) condition:
(uint32(0) == 0x4464c457f) and (all of them)
} }
rule apt_nix_elf_derusbi_kernelModule : APT Derusbi ELF
rule apt_nix_elf_derusbi_kernelModule
{ {
meta:
meta:
Author = "@seifreed" Author = "@seifreed"
strings:
$ = "__this_module" strings:
$ = "init_module" $ = "__this_module"
$ = "unhide_pid" $ = "init_module"
$ = "is_hidden_pid" $ = "unhide_pid"
$ = "clear_hidden_pid" $ = "is_hidden_pid"
$ = "hide_pid" $ = "clear_hidden_pid"
$ = "license" $ = "hide_pid"
$ = "description" $ = "license"
$ = "srcversion=" $ = "description"
$ = "depends=" $ = "srcversion="
$ = "vermagic=" $ = "depends="
$ = "current_task" $ = "vermagic="
$ = "sock_release" $ = "current_task"
$ = "module_layout" $ = "sock_release"
$ = "init_uts_ns" $ = "module_layout"
$ = "init_net" $ = "init_uts_ns"
$ = "init_task" $ = "init_net"
$ = "filp_open" $ = "init_task"
$ = "__netlink_kernel_create" $ = "filp_open"
$ = "kfree_skb" $ = "__netlink_kernel_create"
$ = "kfree_skb"
condition:
(uint32(0) == 0x4464c457f) and (all of them) condition:
(uint32(0) == 0x4464c457f) and (all of them)
} }
rule apt_nix_elf_Derusbi_Linux_SharedMemCreation : APT Derusbi ELF rule apt_nix_elf_Derusbi_Linux_SharedMemCreation : APT Derusbi ELF
{ {
meta:
meta:
Author = "@seifreed" Author = "@seifreed"
strings:
$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 } strings:
condition: $byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
(uint32(0) == 0x464C457F) and (any of them)
condition:
(uint32(0) == 0x464C457F) and (any of them)
} }
rule apt_nix_elf_Derusbi_Linux_Strings : APT Derusbi ELF rule apt_nix_elf_Derusbi_Linux_Strings
{ {
meta:
meta:
Author = "@seifreed" Author = "@seifreed"
strings:
$a1 = "loadso" wide ascii fullword strings:
$a2 = "\nuname -a\n\n" wide ascii $a1 = "loadso" wide ascii fullword
$a3 = "/dev/shm/.x11.id" wide ascii $a2 = "\nuname -a\n\n" wide ascii
$a4 = "LxMain64" wide ascii nocase $a3 = "/dev/shm/.x11.id" wide ascii
$a5 = "# \\u@\\h:\\w \\$ " wide ascii $a4 = "LxMain64" wide ascii nocase
$b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide $a5 = "# \\u@\\h:\\w \\$ " wide ascii
$b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide $b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
$b3 = "ret %d" wide fullword $b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
$b4 = "uname -a\n\n" wide ascii $b3 = "ret %d" wide fullword
$b5 = "/proc/%u/cmdline" wide ascii $b4 = "uname -a\n\n" wide ascii
$b6 = "/proc/self/exe" wide ascii $b5 = "/proc/%u/cmdline" wide ascii
$b7 = "cp -a %s %s" wide ascii $b6 = "/proc/self/exe" wide ascii
$c1 = "/dev/pts/4" wide ascii fullword $b7 = "cp -a %s %s" wide ascii
$c2 = "/tmp/1408.log" wide ascii fullword $c1 = "/dev/pts/4" wide ascii fullword
condition: $c2 = "/tmp/1408.log" wide ascii fullword
uint32(0) == 0x464C457F and
((1 of ($a*) and 4 of ($b*)) or condition:
(1 of ($a*) and 1 of ($c*)) or uint32(0) == 0x464C457F and ((1 of ($a*) and 4 of ($b*)) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*))
2 of ($a*) or
all of ($b*))
} }
rule apt_win_exe_trojan_derusbi : APT Derusbi rule apt_win_exe_trojan_derusbi
{ {
meta: meta:
Author = "@seifreed" Author = "@seifreed"
strings: strings:
$sa_1 = "USB" wide ascii $sa_1 = "USB" wide ascii
$sa_2 = "RAM" wide ascii $sa_2 = "RAM" wide ascii
$sa_3 = "SHARE" wide ascii $sa_3 = "SHARE" wide ascii
$sa_4 = "HOST: %s:%d" $sa_4 = "HOST: %s:%d"
$sa_5 = "POST" $sa_5 = "POST"
$sa_6 = "User-Agent: Mozilla" $sa_6 = "User-Agent: Mozilla"
$sa_7 = "Proxy-Connection: Keep-Alive" $sa_7 = "Proxy-Connection: Keep-Alive"
$sa_8 = "Connection: Keep-Alive" $sa_8 = "Connection: Keep-Alive"
$sa_9 = "Server: Apache" $sa_9 = "Server: Apache"
$sa_10 = "HTTP/1.1" $sa_10 = "HTTP/1.1"
$sa_11 = "ImagePath" $sa_11 = "ImagePath"
$sa_12 = "ZwUnloadDriver" $sa_12 = "ZwUnloadDriver"
$sa_13 = "ZwLoadDriver" $sa_13 = "ZwLoadDriver"
$sa_14 = "ServiceMain" $sa_14 = "ServiceMain"
$sa_15 = "regsvr32.exe" $sa_15 = "regsvr32.exe"
$sa_16 = "/s /u" wide ascii $sa_16 = "/s /u" wide ascii
$sa_17 = "rand" $sa_17 = "rand"
$sa_18 = "_time64" $sa_18 = "_time64"
$sa_19 = "DllRegisterServer" $sa_19 = "DllRegisterServer"
$sa_20 = "DllUnregisterServer" $sa_20 = "DllUnregisterServer"
$sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 } // Decode Driver $sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 } // Decode Driver
$sb_1 = "PCC_CMD_PACKET"
$sb_1 = "PCC_CMD_PACKET" $sb_2 = "PCC_CMD"
$sb_2 = "PCC_CMD" $sb_3 = "PCC_BASEMOD"
$sb_3 = "PCC_BASEMOD" $sb_4 = "PCC_PROXY"
$sb_4 = "PCC_PROXY" $sb_5 = "PCC_SYS"
$sb_5 = "PCC_SYS" $sb_6 = "PCC_PROCESS"
$sb_6 = "PCC_PROCESS" $sb_7 = "PCC_FILE"
$sb_7 = "PCC_FILE" $sb_8 = "PCC_SOCK"
$sb_8 = "PCC_SOCK" $sc_1 = "bcdedit -set testsigning" wide ascii
$sc_2 = "update.microsoft.com" wide ascii
$sc_1 = "bcdedit -set testsigning" wide ascii $sc_3 = "_crt_debugger_hook" wide ascii
$sc_2 = "update.microsoft.com" wide ascii $sc_4 = "ue8G5" wide ascii
$sc_3 = "_crt_debugger_hook" wide ascii $sd_1 = "NET" wide ascii
$sc_4 = "ue8G5" wide ascii $sd_2 = "\\\\.\\pipe\\%s" wide ascii
$sd_3 = ".dat" wide ascii
$sd_1 = "NET" wide ascii $sd_4 = "CONNECT %s:%d" wide ascii
$sd_2 = "\\\\.\\pipe\\%s" wide ascii $sd_5 = "\\Device\\" wide ascii
$sd_3 = ".dat" wide ascii $se_1 = "-%s-%04d" wide ascii
$sd_4 = "CONNECT %s:%d" wide ascii $se_2 = "-%04d" wide ascii
$sd_5 = "\\Device\\" wide ascii $se_3 = "FAL" wide ascii
$se_4 = "OK" wide ascii
$se_1 = "-%s-%04d" wide ascii $se_5 = "2.03" wide ascii
$se_2 = "-%04d" wide ascii $se_6 = "XXXXXXXXXXXXXXX" wide ascii
$se_3 = "FAL" wide ascii
$se_4 = "OK" wide ascii
$se_5 = "2.03" wide ascii
$se_6 = "XXXXXXXXXXXXXXX" wide ascii
condition: condition:
(uint16(0) == 0x5A4D) and ( (all of ($sa_*)) or ( (uint16(0) == 0x5A4D) and ( (all of ($sa_*)) or ((13 of ($sa_*)) and ( (5 of ($sb_*)) or (3 of ($sc_*)) or (all of ($sd_*)) or ( (1 of ($sc_*)) and (all of ($se_*)) ) ) ) )
(13 of ($sa_*)) and
( (5 of ($sb_*)) or (3 of ($sc_*)) or (all of ($sd_*)) or
( (1 of ($sc_*)) and (all of ($se_*)) ) ) ) )
} }
rule Trojan_Derusbi : APT Derusbi { rule Trojan_Derusbi
{
meta: meta:
Author = "RSA_IR" Author = "RSA_IR"
Date = "4Sept13" Date = "4Sept13"
...@@ -200,138 +203,158 @@ rule Trojan_Derusbi : APT Derusbi { ...@@ -200,138 +203,158 @@ rule Trojan_Derusbi : APT Derusbi {
2 of ($b1, $b2, $b3, $b4) and 1 of ($b5, $b6, $b7, $b8) 2 of ($b1, $b2, $b3, $b4) and 1 of ($b5, $b6, $b7, $b8)
} }
rule APT_Derusbi_DeepPanda : APT Derusbi ELF DeepPanda rule APT_Derusbi_DeepPanda
{ {
meta: meta:
author = "ThreatConnect Intelligence Research Team" author = "ThreatConnect Intelligence Research Team"
reference = "http://www.crowdstrike.com/sites/default/files/AdversaryIntelligenceReport_DeepPanda_0.pdf" reference = "http://www.crowdstrike.com/sites/default/files/AdversaryIntelligenceReport_DeepPanda_0.pdf"
strings: strings:
$D = "Dom4!nUserP4ss" wide ascii $D = "Dom4!nUserP4ss" wide ascii
condition: condition:
$D $D
} }
rule APT_Derusbi_Gen : APT Derusbi rule APT_Derusbi_Gen
{ {
meta: meta:
author = "ThreatConnect Intelligence Research Team" author = "ThreatConnect Intelligence Research Team"
strings: strings:
$2 = "273ce6-b29f-90d618c0" wide ascii $2 = "273ce6-b29f-90d618c0" wide ascii
$A = "Ace123dx" fullword wide ascii $A = "Ace123dx" fullword wide ascii
$A1 = "Ace123dxl!" fullword wide ascii $A1 = "Ace123dxl!" fullword wide ascii
$A2 = "Ace123dx!@#x" fullword wide ascii $A2 = "Ace123dx!@#x" fullword wide ascii
$C = "/Catelog/login1.asp" wide ascii $C = "/Catelog/login1.asp" wide ascii
$DF = "~DFTMP$$$$$.1" wide ascii $DF = "~DFTMP$$$$$.1" wide ascii
$G = "GET /Query.asp?loginid=" wide ascii $G = "GET /Query.asp?loginid=" wide ascii
$L = "LoadConfigFromReg failded" wide ascii $L = "LoadConfigFromReg failded" wide ascii
$L1 = "LoadConfigFromBuildin success" wide ascii $L1 = "LoadConfigFromBuildin success" wide ascii
$ph = "/photoe/photo.asp HTTP" wide ascii $ph = "/photoe/photo.asp HTTP" wide ascii
$PO = "POST /photos/photo.asp" wide ascii $PO = "POST /photos/photo.asp" wide ascii
$PC = "PCC_IDENT" wide ascii $PC = "PCC_IDENT" wide ascii
condition: condition:
any of them any of them
} }
/* /*
Yara Rule Set Yara Rule Set
Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud
Date: 2015-12-09 Date: 2015-12-09
Reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family Reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family
Identifier: Derusbi Dez 2015 Identifier: Derusbi Dez 2015
*/ */
rule derusbi_kernel : APT Derusbi rule derusbi_kernel
{ {
meta: meta:
description = "Derusbi Driver version" description = "Derusbi Driver version"
date = "2015-12-09" date = "2015-12-09"
author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud" author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
strings: strings:
$token1 = "$$$--Hello" $token1 = "$$$--Hello"
$token2 = "Wrod--$$$" $token2 = "Wrod--$$$"
$cfg = "XXXXXXXXXXXXXXX" $cfg = "XXXXXXXXXXXXXXX"
$class = ".?AVPCC_BASEMOD@@" $class = ".?AVPCC_BASEMOD@@"
$MZ = "MZ" $MZ = "MZ"
condition: condition:
$MZ at 0 and $token1 and $token2 and $cfg and $class $MZ at 0 and $token1 and $token2 and $cfg and $class
} }
rule derusbi_linux : APT Derusbi ELF rule derusbi_linux
{ {
meta: meta:
description = "Derusbi Server Linux version" description = "Derusbi Server Linux version"
date = "2015-12-09" date = "2015-12-09"
author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud" author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
strings: strings:
$PS1 = "PS1=RK# \\u@\\h:\\w \\$" $PS1 = "PS1=RK# \\u@\\h:\\w \\$"
$cmd = "unset LS_OPTIONS;uname -a" $cmd = "unset LS_OPTIONS;uname -a"
$pname = "[diskio]" $pname = "[diskio]"
$rkfile = "/tmp/.secure" $rkfile = "/tmp/.secure"
$ELF = "\x7fELF" $ELF = "\x7fELF"
condition: condition:
$ELF at 0 and $PS1 and $cmd and $pname and $rkfile $ELF at 0 and $PS1 and $cmd and $pname and $rkfile
} }
/* /*
Yara Rule Set Yara Rule Set
Author: Florian Roth Author: Florian Roth
Date: 2015-12-15 Date: 2015-12-15
Identifier: Derusbi Dez 2015 Identifier: Derusbi Dez 2015
*/ */
rule Derusbi_Kernel_Driver_WD_UDFS : APT Derusbi { rule Derusbi_Kernel_Driver_WD_UDFS
meta: {
description = "Detects Derusbi Kernel Driver"
author = "Florian Roth" meta:
reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family" description = "Detects Derusbi Kernel Driver"
date = "2015-12-15" author = "Florian Roth"
score = 80 reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016" date = "2015-12-15"
hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a" score = 80
hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58" hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59" hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
strings: hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
$x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"
$x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
$x3 = "\\??\\pipe\\usbpcex%d" fullword wide strings:
$x4 = "\\??\\pipe\\usbpcg%d" fullword wide $x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
$x5 = "$$$--Hello" fullword ascii $x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
$x6 = "Wrod--$$$" fullword ascii $x3 = "\\??\\pipe\\usbpcex%d" fullword wide
$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide $x5 = "$$$--Hello" fullword ascii
$s2 = "Update.dll" fullword ascii $x6 = "Wrod--$$$" fullword ascii
$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide $s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
$s4 = "\\Driver\\nsiproxy" fullword wide $s2 = "Update.dll" fullword ascii
$s5 = "HOST: %s" fullword ascii $s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" fullword wide
condition: $s4 = "\\Driver\\nsiproxy" fullword wide
uint16(0) == 0x5a4d and filesize < 800KB and $s5 = "HOST: %s" fullword ascii
(
2 of ($x*) or all of ($s*) condition:
) uint16(0) == 0x5a4d and filesize < 800KB and (2 of ($x*) or all of ($s*))
} }
rule Derusbi_Code_Signing_Cert : APT Derusbi { rule Derusbi_Code_Signing_Cert
meta: {
description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
author = "Florian Roth" meta:
reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family" description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
date = "2015-12-15" author = "Florian Roth"
score = 40 reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
date = "2015-12-15"
score = 40
strings: strings:
$s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii $s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
$s2 = "XL Games Co.,Ltd.0" fullword ascii $s2 = "XL Games Co.,Ltd.0" fullword ascii
$s3 = "Wemade Entertainment co.,Ltd0" fullword ascii $s3 = "Wemade Entertainment co.,Ltd0" fullword ascii
condition: condition:
uint16(0) == 0x5a4d and filesize < 800KB and 1 of them uint16(0) == 0x5a4d and filesize < 800KB and 1 of them
} }
rule XOR_4byte_Key : APT Derusbi { rule XOR_4byte_Key
meta: {
description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
author = "Florian Roth" meta:
reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family" description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
date = "2015-12-15" author = "Florian Roth"
score = 60 reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
date = "2015-12-15"
score = 60
strings: strings:
/* Op Code */ /* Op Code */
$s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 } $s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
...@@ -344,16 +367,18 @@ rule XOR_4byte_Key : APT Derusbi { ...@@ -344,16 +367,18 @@ rule XOR_4byte_Key : APT Derusbi {
dec ecx dec ecx
jmp short loc_590162 jmp short loc_590162
*/ */
condition: condition:
uint16(0) == 0x5a4d and filesize < 900KB and all of them uint16(0) == 0x5a4d and filesize < 900KB and all of them
} }
rule apt_win32_dll_bergard_pgv_pvid_variant : Win32 Derusbi rule apt_win32_dll_bergard_pgv_pvid_variant
{ {
meta: meta:
copyright = "Fidelis Cybersecurity" copyright = "Fidelis Cybersecurity"
reference = "http://www.threatgeek.com/2016/05/turbo-twist-two-64-bit-derusbi-strains-converge.html" reference = "http://www.threatgeek.com/2016/05/turbo-twist-two-64-bit-derusbi-strains-converge.html"
strings: strings:
$ = "Accept:" $ = "Accept:"
$ = "User-Agent: %s" $ = "User-Agent: %s"
...@@ -369,6 +394,5 @@ rule apt_win32_dll_bergard_pgv_pvid_variant : Win32 Derusbi ...@@ -369,6 +394,5 @@ rule apt_win32_dll_bergard_pgv_pvid_variant : Win32 Derusbi
$ = "HTTP/1.0" $ = "HTTP/1.0"
condition: condition:
(uint16(0) == 0x5A4D) and (all of them) (uint16(0) == 0x5A4D) and (all of them)
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment