Create Adwind_JAR_PACKB

fbdf0842 · Marc Rivero López · 3da35ca4 · fbdf0842
Commit fbdf0842 authored Feb 09, 2016 by Marc Rivero López
Show whitespace changes
Inline Side-by-side

Showing with 13 additions and 0 deletions

Adwind_JAR_PACKB malware/Adwind_JAR_PACKB +13 -0

No files found.
--- a/malware/Adwind_JAR_PACKB
+++ b/malware/Adwind_JAR_PACKB
+rule Adwind_JAR_PACKB {
+ meta:
+  author = “Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com”
+  reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf"
+  last_modi ed = “2015-11-30”
+ strings:
+  $c1 = “META-INF/MANIFEST.MF” ascii
+  $c2 = “main/Start.class” ascii
+  $a1 = “con g/con g.perl” ascii
+  $b1 = “java/textito.isn” ascii
+ condition:
+  int16(0) == 0x4B50 and ($c1 and $c2 and ($a1 or $b1))
+}