Commit a63977cc by Antonio S

Fixed bad example sample and add one more rule

parent 1f8c2e21
rule genericSMS : smsFraud
{
meta:
author = "https://twitter.com/plutec_net"
reference = "https://koodous.com/"
sample = "e6ef34577a75fc0dc0a1f473304de1fc3a0d7d330bf58448db5f3108ed92741b"
author = "https://twitter.com/plutec_net"
reference = "https://koodous.com/"
sample = "3fc533d832e22dc3bc161e5190edf242f70fbc4764267ca073de5a8e3ae23272"
sample2 = "3d85bdd0faea9c985749c614a0676bb05f017f6bde3651f2b819c7ac40a02d5f"
strings:
$a = "SHA1-Digest: +RsrTx5SNjstrnt7pNaeQAzY4kc="
......@@ -14,4 +15,24 @@ rule genericSMS : smsFraud
condition:
all of them
}
\ No newline at end of file
}
rule genericSMS2 : smsFraud
{
meta:
author = "https://twitter.com/plutec_net"
reference = "https://koodous.com/"
sample = "1f23524e32c12c56be0c9a25c69ab7dc21501169c57f8d6a95c051397263cf9f"
sample2 = "2cf073bd8de8aad6cc0d6ad5c98e1ba458bd0910b043a69a25aabdc2728ea2bd"
sample3 = "20575a3e5e97bcfbf2c3c1d905d967e91a00d69758eb15588bdafacb4c854cba"
strings:
$a = "NotLeftTriangleEqual=022EC"
$b = "SHA1-Digest: X27Zpw9c6eyXvEFuZfCL2LmumtI="
$c = "_ZNSt12_Vector_baseISsSaISsEE13_M_deallocateEPSsj"
$d = "FBTP2AHR3WKC6LEYON7D5GZXVISMJ4QU"
condition:
all of them
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment