Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
rules
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
rules
Commits
9b002f17
Commit
9b002f17
authored
Jan 06, 2016
by
Adam Polkosnik [fun]
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Update rovnix to replace M$ word quotes with ASCII quotation marks
parent
29ffb307
Show whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
17 additions
and
17 deletions
+17
-17
rovnix_downloader_sinkhole_check.yar
malware/rovnix_downloader_sinkhole_check.yar
+17
-17
No files found.
malware/rovnix_downloader_sinkhole_check.yar
View file @
9b002f17
rule rovnix_downloader
{
meta:
author=
”Intel Security”
description=
”Rovnix downloader with sinkhole checks”
author=
"Intel Security"
description=
"Rovnix downloader with sinkhole checks"
reference = "https://blogs.mcafee.com/mcafee-labs/rovnix-downloader-sinkhole-time-checks/"
strings:
$sink1=
”control”
$sink2 =
“sink”
$sink3 =
“hole”
$sink4=
“dynadot”
$sink5=
“block”
$sink6=
“malw”
$sink7=
“anti”
$sink8=
“googl”
$sink9=
“hack”
$sink10=
“trojan”
$sink11=
“abuse”
$sink12=
“virus”
$sink13=
“black”
$sink14=
“spam”
$boot=
“BOOTKIT_DLL.dll”
$sink1=
"control"
$sink2 =
"sink"
$sink3 =
"hole"
$sink4=
"dynadot"
$sink5=
"block"
$sink6=
"malw"
$sink7=
"anti"
$sink8=
"googl"
$sink9=
"hack"
$sink10=
"trojan"
$sink11=
"abuse"
$sink12=
"virus"
$sink13=
"black"
$sink14=
"spam"
$boot=
"BOOTKIT_DLL.dll"
$mz = { 4D 5A }
condition:
$mz in (0..2) and all of ($sink*) and $boot
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment