Skip to content

R
rules
Commit f1d9f781 by Marc Rivero López Committed by GitHub
Options

Update APT_FiveEyes.yar 

fixed style rule
parent a2f7d48f
Showing with 252 additions and 215 deletions
malware/APT_FiveEyes.yar
...@@ -8,234 +8,271 @@ import "pe" ...@@ -8,234 +8,271 @@ import "pe"
/* FIVE EYES ------------------------------------------------------------------------------- */ /* FIVE EYES ------------------------------------------------------------------------------- */
rule FiveEyes_QUERTY_Malwareqwerty_20121 { rule FiveEyes_QUERTY_Malwareqwerty_20121
meta: {
description = "FiveEyes QUERTY Malware - file 20121.xml"
author = "Florian Roth" meta:
reference = "http://www.spiegel.de/media/media-35668.pdf" description = "FiveEyes QUERTY Malware - file 20121.xml"
date = "2015/01/18" author = "Florian Roth"
hash = "8263fb58350f3b1d3c4220a602421232d5e40726" reference = "http://www.spiegel.de/media/media-35668.pdf"
strings: date = "2015/01/18"
$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
$s1 = "<name>20121.dll</name>" fullword ascii
$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii strings:
$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii $s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
$s4 = "<platform type=\"1\">" fullword ascii $s1 = "<name>20121.dll</name>" fullword ascii
$s5 = "</plugin>" fullword ascii $s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
$s6 = "</pluginConfig>" fullword ascii $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
$s7 = "<pluginConfig>" fullword ascii $s4 = "<platform type=\"1\">" fullword ascii
$s8 = "</platform>" fullword ascii $s5 = "</plugin>" fullword ascii
$s9 = "</lpConfig>" fullword ascii $s6 = "</pluginConfig>" fullword ascii
$s10 = "<lpConfig>" fullword ascii $s7 = "<pluginConfig>" fullword ascii
condition: $s8 = "</platform>" fullword ascii
9 of them $s9 = "</lpConfig>" fullword ascii
$s10 = "<lpConfig>" fullword ascii
condition:
9 of them
} }
rule FiveEyes_QUERTY_Malwaresig_20123_sys { rule FiveEyes_QUERTY_Malwaresig_20123_sys
meta: {
description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
author = "Florian Roth" meta:
reference = "http://www.spiegel.de/media/media-35668.pdf" description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
date = "2015/01/18" author = "Florian Roth"
hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099" reference = "http://www.spiegel.de/media/media-35668.pdf"
strings: date = "2015/01/18"
$s0 = "20123.dll" fullword ascii hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
$s1 = "kbdclass.sys" fullword wide
$s2 = "IoFreeMdl" fullword ascii strings:
$s3 = "ntoskrnl.exe" fullword ascii $s0 = "20123.dll" fullword ascii
$s4 = "KfReleaseSpinLock" fullword ascii $s1 = "kbdclass.sys" fullword wide
condition: $s2 = "IoFreeMdl" fullword ascii
all of them $s3 = "ntoskrnl.exe" fullword ascii
$s4 = "KfReleaseSpinLock" fullword ascii
condition:
all of them
} }
rule FiveEyes_QUERTY_Malwaresig_20123_cmdDef { rule FiveEyes_QUERTY_Malwaresig_20123_cmdDef
meta: {
description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
author = "Florian Roth" meta:
reference = "http://www.spiegel.de/media/media-35668.pdf" description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
date = "2015/01/18" author = "Florian Roth"
hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd" reference = "http://www.spiegel.de/media/media-35668.pdf"
strings: date = "2015/01/18"
$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
$s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
$s2 = "<commands/>" fullword ascii strings:
$s3 = "</version>" fullword ascii $s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
$s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii $s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
$s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii $s2 = "<commands/>" fullword ascii
$s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii $s3 = "</version>" fullword ascii
$s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii $s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
$s8 = "<dllDepend>None</dllDepend>" fullword ascii $s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
$s9 = "<minorType>0</minorType>" fullword ascii $s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
$s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii $s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
$s11 = "</comments>" fullword ascii $s8 = "<dllDepend>None</dllDepend>" fullword ascii
$s12 = "<comments>" fullword ascii $s9 = "<minorType>0</minorType>" fullword ascii
$s13 = "<majorType>1</majorType>" fullword ascii $s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
$s14 = "<files>None</files>" fullword ascii $s11 = "</comments>" fullword ascii
$s15 = "<poc>Erebus</poc>" fullword ascii $s12 = "<comments>" fullword ascii
$s16 = "</plugin>" fullword ascii $s13 = "<majorType>1</majorType>" fullword ascii
$s17 = "<team>None</team>" fullword ascii $s14 = "<files>None</files>" fullword ascii
$s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii $s15 = "<poc>Erebus</poc>" fullword ascii
$s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii $s16 = "</plugin>" fullword ascii
$s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii $s17 = "<team>None</team>" fullword ascii
condition: $s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
14 of them $s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
$s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii
condition:
14 of them
} }
rule FiveEyes_QUERTY_Malwaresig_20121_dll { rule FiveEyes_QUERTY_Malwaresig_20121_dll
meta: {
description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
author = "Florian Roth" meta:
reference = "http://www.spiegel.de/media/media-35668.pdf" description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
date = "2015/01/18" author = "Florian Roth"
hash = "89504d91c5539a366e153894c1bc17277116342b" reference = "http://www.spiegel.de/media/media-35668.pdf"
strings: date = "2015/01/18"
$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii hash = "89504d91c5539a366e153894c1bc17277116342b"
$s1 = "20121.dll" fullword ascii
condition: strings:
all of them $s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
$s1 = "20121.dll" fullword ascii
condition:
all of them
} }
rule FiveEyes_QUERTY_Malwareqwerty_20123 {
meta: rule FiveEyes_QUERTY_Malwareqwerty_20123
description = "FiveEyes QUERTY Malware - file 20123.xml" {
author = "Florian Roth"
reference = "http://www.spiegel.de/media/media-35668.pdf" meta:
date = "2015/01/18" description = "FiveEyes QUERTY Malware - file 20123.xml"
hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9" author = "Florian Roth"
strings: reference = "http://www.spiegel.de/media/media-35668.pdf"
$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii date = "2015/01/18"
$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
$s2 = "<name>20123.sys</name>" fullword ascii
$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii strings:
$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii $s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
$s5 = "<platform type=\"1\">" fullword ascii $s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
$s6 = "</plugin>" fullword ascii $s2 = "<name>20123.sys</name>" fullword ascii
$s7 = "</pluginConfig>" fullword ascii $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
$s8 = "<pluginConfig>" fullword ascii $s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
$s9 = "</platform>" fullword ascii $s5 = "<platform type=\"1\">" fullword ascii
$s10 = "</lpConfig>" fullword ascii $s6 = "</plugin>" fullword ascii
$s11 = "<lpConfig>" fullword ascii $s7 = "</pluginConfig>" fullword ascii
condition: $s8 = "<pluginConfig>" fullword ascii
9 of them $s9 = "</platform>" fullword ascii
$s10 = "</lpConfig>" fullword ascii
$s11 = "<lpConfig>" fullword ascii
condition:
9 of them
} }
rule FiveEyes_QUERTY_Malwaresig_20120_dll { rule FiveEyes_QUERTY_Malwaresig_20120_dll
meta: {
description = "FiveEyes QUERTY Malware - file 20120.dll.bin"
author = "Florian Roth" meta:
reference = "http://www.spiegel.de/media/media-35668.pdf" description = "FiveEyes QUERTY Malware - file 20120.dll.bin"
date = "2015/01/18" author = "Florian Roth"
hash = "6811bfa3b8cda5147440918f83c40237183dbd25" reference = "http://www.spiegel.de/media/media-35668.pdf"
strings: date = "2015/01/18"
$s0 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.txt" fullword wide hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
$s1 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.xml" fullword wide
$s2 = "Failed to send the EQwerty_driverStatusCommand to the implant." fullword ascii strings:
$s3 = "- Log Used (number of windows) - %d" fullword wide $s0 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.txt" fullword wide
$s4 = "- Log Limit (number of windows) - %d" fullword wide $s1 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.xml" fullword wide
$s5 = "Process or User Default Language" fullword wide $s2 = "Failed to send the EQwerty_driverStatusCommand to the implant." fullword ascii
$s6 = "Windows 98/Me, Windows NT 4.0 and later: Vietnamese" fullword wide $s3 = "- Log Used (number of windows) - %d" fullword wide
$s7 = "- Logging of keystrokes is switched ON" fullword wide $s4 = "- Log Limit (number of windows) - %d" fullword wide
$s8 = "- Logging of keystrokes is switched OFF" fullword wide $s5 = "Process or User Default Language" fullword wide
$s9 = "Qwerty is currently logging active windows with titles containing the fo" wide $s6 = "Windows 98/Me, Windows NT 4.0 and later: Vietnamese" fullword wide
$s10 = "Windows 95, Windows NT 4.0 only: Korean (Johab)" fullword wide $s7 = "- Logging of keystrokes is switched ON" fullword wide
$s11 = "FAILED to get Qwerty Status" fullword wide $s8 = "- Logging of keystrokes is switched OFF" fullword wide
$s12 = "- Successfully retrieved Log from Implant." fullword wide $s9 = "Qwerty is currently logging active windows with titles containing the fo" wide
$s13 = "- Logging of all Windows is toggled ON" fullword wide $s10 = "Windows 95, Windows NT 4.0 only: Korean (Johab)" fullword wide
$s14 = "- Logging of all Windows is toggled OFF" fullword wide $s11 = "FAILED to get Qwerty Status" fullword wide
$s15 = "Qwerty FAILED to retrieve window list." fullword wide $s12 = "- Successfully retrieved Log from Implant." fullword wide
$s16 = "- UNSUCCESSFUL Log Retrieval from Implant." fullword wide $s13 = "- Logging of all Windows is toggled ON" fullword wide
$s17 = "The implant failed to return a valid status" fullword ascii $s14 = "- Logging of all Windows is toggled OFF" fullword wide
$s18 = "- Log files were NOT generated!" fullword wide $s15 = "Qwerty FAILED to retrieve window list." fullword wide
$s19 = "Windows 2000/XP: Armenian. This is Unicode only." fullword wide $s16 = "- UNSUCCESSFUL Log Retrieval from Implant." fullword wide
$s20 = "- This machine is using a PS/2 Keyboard - Continue on using QWERTY" fullword wide $s17 = "The implant failed to return a valid status" fullword ascii
condition: $s18 = "- Log files were NOT generated!" fullword wide
10 of them $s19 = "Windows 2000/XP: Armenian. This is Unicode only." fullword wide
$s20 = "- This machine is using a PS/2 Keyboard - Continue on using QWERTY" fullword wide
condition:
10 of them
} }
rule FiveEyes_QUERTY_Malwaresig_20120_cmdDef { rule FiveEyes_QUERTY_Malwaresig_20120_cmdDef
meta: {
description = "FiveEyes QUERTY Malware - file 20120_cmdDef.xml"
author = "Florian Roth" meta:
reference = "http://www.spiegel.de/media/media-35668.pdf" description = "FiveEyes QUERTY Malware - file 20120_cmdDef.xml"
date = "2015/01/18" author = "Florian Roth"
hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea" reference = "http://www.spiegel.de/media/media-35668.pdf"
strings: date = "2015/01/18"
$s0 = "This PPC gets the current keystroke log." fullword ascii hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
$s1 = "This command will add the given WindowTitle to the list of Windows to log keys f" ascii
$s2 = "This command will remove the WindowTitle corresponding to the given window title" ascii strings:
$s3 = "This command will return the current status of the Keyboard Logger (Whether it i" ascii $s0 = "This PPC gets the current keystroke log." fullword ascii
$s4 = "This command Toggles logging of all Keys. If allkeys is toggled all keystrokes w" ascii $s1 = "This command will add the given WindowTitle to the list of Windows to log keys f" ascii
$s5 = "<definition>Turn logging of all keys on|off</definition>" fullword ascii $s2 = "This command will remove the WindowTitle corresponding to the given window title" ascii
$s6 = "<name>Get Keystroke Log</name>" fullword ascii $s3 = "This command will return the current status of the Keyboard Logger (Whether it i" ascii
$s7 = "<description>Keystroke Logger Lp Plugin</description>" fullword ascii $s4 = "This command Toggles logging of all Keys. If allkeys is toggled all keystrokes w" ascii
$s8 = "<definition>display help for this function</definition>" fullword ascii $s5 = "<definition>Turn logging of all keys on|off</definition>" fullword ascii
$s9 = "This command will switch ON Logging of keys. All keys taht are entered to a acti" ascii $s6 = "<name>Get Keystroke Log</name>" fullword ascii
$s10 = "Set the log limit (in number of windows)" fullword ascii $s7 = "<description>Keystroke Logger Lp Plugin</description>" fullword ascii
$s11 = "<example>qwgetlog</example>" fullword ascii $s8 = "<definition>display help for this function</definition>" fullword ascii
$s12 = "<aliasName>qwgetlog</aliasName>" fullword ascii $s9 = "This command will switch ON Logging of keys. All keys taht are entered to a acti" ascii
$s13 = "<definition>The title of the Window whose keys you wish to Log once it becomes a" ascii $s10 = "Set the log limit (in number of windows)" fullword ascii
$s14 = "This command will switch OFF Logging of keys. No keystrokes will be captured" fullword ascii $s11 = "<example>qwgetlog</example>" fullword ascii
$s15 = "<definition>The title of the Window whose keys you no longer whish to log</defin" ascii $s12 = "<aliasName>qwgetlog</aliasName>" fullword ascii
$s16 = "<command id=\"32\">" fullword ascii $s13 = "<definition>The title of the Window whose keys you wish to Log once it becomes a" ascii
$s17 = "<command id=\"3\">" fullword ascii $s14 = "This command will switch OFF Logging of keys. No keystrokes will be captured" fullword ascii
$s18 = "<command id=\"7\">" fullword ascii $s15 = "<definition>The title of the Window whose keys you no longer whish to log</defin" ascii
$s19 = "<command id=\"1\">" fullword ascii $s16 = "<command id=\"32\">" fullword ascii
$s20 = "<command id=\"4\">" fullword ascii $s17 = "<command id=\"3\">" fullword ascii
condition: $s18 = "<command id=\"7\">" fullword ascii
10 of them $s19 = "<command id=\"1\">" fullword ascii
$s20 = "<command id=\"4\">" fullword ascii
condition:
10 of them
} }
rule FiveEyes_QUERTY_Malwareqwerty_20120 { rule FiveEyes_QUERTY_Malwareqwerty_20120
meta: {
description = "FiveEyes QUERTY Malware - file 20120.xml"
author = "Florian Roth" meta:
reference = "http://www.spiegel.de/media/media-35668.pdf" description = "FiveEyes QUERTY Malware - file 20120.xml"
date = "2015/01/18" author = "Florian Roth"
hash = "597082f05bfd3225587d480c30f54a7a1326a892" reference = "http://www.spiegel.de/media/media-35668.pdf"
strings: date = "2015/01/18"
$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii hash = "597082f05bfd3225587d480c30f54a7a1326a892"
$s1 = "<name>20120.dll</name>" fullword ascii
$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii strings:
$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii $s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
$s4 = "<platform type=\"1\">" fullword ascii $s1 = "<name>20120.dll</name>" fullword ascii
$s5 = "</plugin>" fullword ascii $s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
$s6 = "</pluginConfig>" fullword ascii $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
$s7 = "<pluginConfig>" fullword ascii $s4 = "<platform type=\"1\">" fullword ascii
$s8 = "</platform>" fullword ascii $s5 = "</plugin>" fullword ascii
$s9 = "</lpConfig>" fullword ascii $s6 = "</pluginConfig>" fullword ascii
$s10 = "<lpConfig>" fullword ascii $s7 = "<pluginConfig>" fullword ascii
condition: $s8 = "</platform>" fullword ascii
all of them $s9 = "</lpConfig>" fullword ascii
$s10 = "<lpConfig>" fullword ascii
condition:
all of them
} }
rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef { rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef
meta: {
description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
author = "Florian Roth" meta:
reference = "http://www.spiegel.de/media/media-35668.pdf" description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
date = "2015/01/18" author = "Florian Roth"
hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907" reference = "http://www.spiegel.de/media/media-35668.pdf"
strings: date = "2015/01/18"
$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
$s1 = "<message>Failed to get File Time</message>" fullword ascii
$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii strings:
$s3 = "<message>Failed to set File Time</message>" fullword ascii $s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
$s4 = "</commands>" fullword ascii $s1 = "<message>Failed to get File Time</message>" fullword ascii
$s5 = "<commands>" fullword ascii $s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
$s6 = "</version>" fullword ascii $s3 = "<message>Failed to set File Time</message>" fullword ascii
$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii $s4 = "</commands>" fullword ascii
$s8 = "<message>No Comms. with Driver</message>" fullword ascii $s5 = "<commands>" fullword ascii
$s9 = "</error>" fullword ascii $s6 = "</version>" fullword ascii
$s10 = "<message>Invalid File Size</message>" fullword ascii $s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii $s8 = "<message>No Comms. with Driver</message>" fullword ascii
$s12 = "<message>File Size Mismatch</message>" fullword ascii $s9 = "</error>" fullword ascii
$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii $s10 = "<message>Invalid File Size</message>" fullword ascii
$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii $s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
$s15 = "<dllDepend>None</dllDepend>" fullword ascii $s12 = "<message>File Size Mismatch</message>" fullword ascii
$s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii $s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
$s17 = "<rightsRequired>None</rightsRequired>" fullword ascii $s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
$s18 = "<minorType>0</minorType>" fullword ascii $s15 = "<dllDepend>None</dllDepend>" fullword ascii
$s19 = "<code>00001002</code>" fullword ascii $s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
$s20 = "<code>00001001</code>" fullword ascii $s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
condition: $s18 = "<minorType>0</minorType>" fullword ascii
12 of them $s19 = "<code>00001002</code>" fullword ascii
$s20 = "<code>00001001</code>" fullword ascii
condition:
12 of them
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment