Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Autogenerated Rules
This file has been truncated, but you can view the full file.
/*
Yara rules to identify malware families, made by Yabin
Auto-generated - plenty of these rules won't work as they rely on looking for compiled code
*/
rule BackdoorAndroidOSCoca_51dc097980b46d053085ff079b153f107d866a27dc19670b79928ec55ab336d7 {
strings:
$a_2 = { 558bebdcdb73a5fdef349bc5b2931e67 }
$a_3 = { 558b9217b81fb2ccf3482605348e0620 }
condition:
2 of them
}
rule BackdoorIRCEvilbot_c6fef53b761d70c2dbb6af5aa2658878420f6969ffd82c59c0e84d1961b27b1f {
strings:
$a_2 = { 5589e551535657ff7508e8e10c000089 }
$a_3 = { 5589e55157e8b200000089c7803f2275 }
$a_4 = { 5589e581ecb800000053565731dbff75 }
$a_5 = { 5589e56aff6814604000689a10400050 }
$a_6 = { 5589e581ec1406000053565731ff89bd }
$a_7 = { 5589e55c556a00376fef6e0168925aff }
$a_8 = { 5589e581ecf400000053565731db8d7d }
$a_9 = { 5589e5b8a0170000e87b230000535657 }
$a_10 = { 5589e581ec380a000053565731db899d }
$a_11 = { 5589e581ec1009000053565731db899d }
condition:
9 of them
}
rule BackdoorJavaJacksbot_f270979a3a4a94151c52032a2a2a95d83ef8ac02e47e191212eaa29fa6eec5d9 {
strings:
$a_2 = { 558b46ae21adb9b5aa91ac6468fbdbdb }
$a_3 = { 558b71a39a983a7ee184edb1cbf5a20d }
$a_4 = { 558be802fc2d64ed5c474659fccecefa }
$a_5 = { 558b91517afa3259dbdf7bc24e619264 }
condition:
4 of them
}
rule BackdoorLinuxMirai_025a8aef2de0b7c60674b823a756c09e92d764f99e6edb80d621ecc58e90ac79 {
strings:
$a_2 = { 5589e583ec08803d2068050800740ceb }
$a_3 = { 5589e557565383ec0c8a5d0c0fb67d10 }
$a_4 = { 5589e553e81300000081c3fbe60000e8 }
$a_5 = { 558b6c243c55e83172000083c42083f8 }
$a_6 = { 5589e55383ec04bb84670508a1846705 }
$a_7 = { 558b4c240c8d043b29c889f350be9001 }
$a_8 = { 558b15b067050852e8df39000083c410 }
$a_9 = { 5589e553e85136ffff81c3391d0000e8 }
$a_10 = { 558b84244c070000408984244c070000 }
$a_11 = { 5589e557565383ec2c8b45108b7d0883 }
$a_12 = { 558bbc24ac51000001fb8d43015056e8 }
condition:
10 of them
}
rule BackdoorLinuxSetag_6946cff77286dd1d9b82cd083779f86b2f908fb2f498637bca4cec3367296604 {
strings:
$a_2 = { 5589e5575653b8d8ffffff658b008b38 }
$a_3 = { 5589e55383ec1483ec08ff75086a1ce8 }
$a_4 = { 5589e5565383ec208b7508c645f601c6 }
$a_5 = { 5589e5b8c7000000cd80c9c390909090 }
$a_6 = { 5589e5565383ec108b7508c706207910 }
$a_7 = { 5589e583ec18c645ff0183ec04ff7510 }
$a_8 = { 5589e557565381ecac000000898560ff }
$a_9 = { 5589e5b80000000085c07409896d0cc9 }
$a_10 = { 5589e557565383ec288945cc8b480485 }
$a_11 = { 5589e55756538b7d088b550c8b5d1085 }
$a_12 = { 5589e5575653508b7d108b45088b7004 }
$a_13 = { 5589e557565383ec2c8b45088b80d400 }
$a_14 = { 5589e55383ec048b450883ec0c50e8f7 }
$a_15 = { 5589e583ec08ba98f60f088b45088910 }
$a_16 = { 5589e5b80000000085c07419b8d4efec }
$a_17 = { 5589e556538b5d088b435c85c0752dc7 }
$a_18 = { 5589e557565383ec108b7d088b750c8b }
$a_19 = { 5589e583ec08b8082c13088a0084c075 }
$a_20 = { 5589e557565383ec1c8945ec8955e889 }
$a_21 = { 5589e5538b5d0883fb1f772f65a10800 }
$a_22 = { 5589e583ec088b450883ec08688c1510 }
$a_23 = { 5589e583ec0883ec086a00ff7508e815 }
$a_24 = { 5589e557565383ec0c8b7d0c8b45148d }
$a_25 = { 5589e5ff75106a00ff750cff7508e855 }
$a_26 = { 5589e557565383ec1c8b75088b561c8b }
$a_27 = { 5589e55383ec048b450883ec0c50e8ff }
$a_28 = { 5589e583ec108b550c8b450889d129c1 }
$a_29 = { 5589e5538b5d0c8b4d10b8c3000000cd }
$a_30 = { 5589e557565383ec3889c689d7688c78 }
condition:
24 of them
}
rule BackdoorLinuxSetag_edf5dbe95655d2f49e4760658ea06da1b96c2df07c5c8958e32f719c45007b20 {
strings:
$a_2 = { 5589e557565383ec1c8b5d0c8b7508c7 }
$a_3 = { 5589e55789cf565383ec448b5d0c8945 }
$a_4 = { 5589e5575653658b1d0000000083ec48 }
$a_5 = { 5589e583e4f883ec088b4508c7442404 }
$a_6 = { 5589e55756538d4a2081ecdc01000083 }
$a_7 = { 5589e583ec188b4508c700c8ed0c08b8 }
$a_8 = { 5589e557565383ec4c83f9018955cc89 }
$a_9 = { 5589e583ec188975f88b75148b450c8b }
$a_10 = { 5589e581ec580800008b4508890424e8 }
$a_11 = { 5589e583ec288b4508890424e8ad5603 }
$a_12 = { 5589e55383ec24c7042400000000e8f7 }
$a_13 = { 5589e557565381eca80000008b4d088b }
$a_14 = { 5589e5575383e4f081ecc00000008d44 }
$a_15 = { 5589e557565381ec1c0200008b4508c7 }
$a_16 = { 5589e557565389c383e4f883ec208b45 }
$a_17 = { 5589e557565383ec7c8b45088b909001 }
$a_18 = { 5589e557565381eca4000000c7442408 }
$a_19 = { 5589e55383ec248b450c890424e8c4ff }
$a_20 = { 5589e5575381ec20040000c744240400 }
$a_21 = { 5589e55789cf5631f65389d381ec4402 }
$a_22 = { 5589e5575681ec600100008b45048db5 }
$a_23 = { 5589e557565381ec901000008b75088d }
$a_24 = { 5589e583e4f883ec080fb65510c74424 }
$a_25 = { 5589e583ec28c745f400000000eb5d8b }
$a_26 = { 5589e557565352508d85e8feffff81ec }
$a_27 = { 5589e55731ff565389cb81ec84000000 }
$a_28 = { 5589e557565383ec3c8b55088b451083 }
$a_29 = { 5589e583ec188b450805000100008904 }
$a_30 = { 558bbba0ffffff8b0785c0741590ffd0 }
condition:
24 of them
}
rule BackdoorLinuxShellshock_1743f358769aae7fb77176ca20cb73ee8f5f4d29f672d28a9967dc737eddf446 {
strings:
$a_2 = { 5589e553bb0030050883ec04a1003005 }
$a_3 = { 5589e581ec78100000c7442408000000 }
$a_4 = { 5589e55781ec34100000c74424040000 }
$a_5 = { 5589e583ec088b45148845fc8b55080f }
$a_6 = { 5589e55781ecd4000000c74424080000 }
$a_7 = { 5589e557565383ec5c0fb60537330508 }
$a_8 = { 5589e583ec28c745f801000000c745fc }
$a_9 = { 5589e55781ecc40000008b45248945e4 }
$a_10 = { 5589e581ec280200008d85fcfdffff89 }
$a_11 = { 5589e583ec18a1a0930508890424e80e }
$a_12 = { 5589e55383ec248b45080fb6000fb6c0 }
$a_13 = { 5589e55383ec34e8b05300008945ec83 }
$a_14 = { 5589e5575381ecf000000089e0898524 }
$a_15 = { 5589e557565381ec0c010000e8584800 }
$a_16 = { 5589e583ec188b4508890424e8f86300 }
$a_17 = { 5589e583ec288b45080fb74002668945 }
$a_18 = { 5589e583ec288d450c8945fc8b45fc89 }
$a_19 = { 5589e583ec08eb1b8b45080fb6000fb6 }
$a_20 = { 5589e583ec108b4508a3403305088b45 }
$a_21 = { 5589e557565381ecac00000089e08945 }
$a_22 = { 5589e581ec28100000c745f800000000 }
$a_23 = { 5589e583ec288d45108945fc8b45fc89 }
$a_24 = { 5589e55783ec1cc745ecc61e05088b45 }
$a_25 = { 5589e55781ecd40000008b55108b450c }
$a_26 = { 5589e553e81300000081c377af0000e8 }
$a_27 = { 5589e583ec388b450c400fb6000fb6c0 }
$a_28 = { 5589e55783ec24c745f4000000008b45 }
$a_29 = { 5589e583ec08803d0033050800740ceb }
$a_30 = { 5589e55756535181ece8140000c70424 }
condition:
24 of them
}
rule BackdoorLinuxTsunami_49cd3083c470fd42977168486193bfa757bf44559d2a63a8564d1f0e32131762 {
strings:
$a_2 = { 554889e5534883ec48897dcc488975c0 }
$a_3 = { 554889e5534883ec38897ddc488975d0 }
$a_4 = { 554889e5488b0596be20004885c07509 }
$a_5 = { 554889e5534883ec48c70598572000ff }
$a_6 = { 554889e54881ec20020000be00000000 }
$a_7 = { 554889e54883ec2048897de8488975e0 }
$a_8 = { 554889e5534883ec08488b0500432000 }
$a_9 = { 554889e5415541545348897dd08975cc }
$a_10 = { 554889e5534881ecd8040000ba000000 }
$a_11 = { 554889e54881ece000000089bd2cffff }
$a_12 = { 554889e5534881ec580a000089bdccf5 }
$a_13 = { 554889e54883ec3048897dd80fb6057c }
$a_14 = { 554889e5534881ec8801000089bd8cfe }
$a_15 = { 554889e5534881ec6806000089bdacf9 }
$a_16 = { 554889e5534881ec7801000089bd9cfe }
$a_17 = { 554889e54883ec20897dfc488975f048 }
$a_18 = { 554889e5534881eca80200004889bd58 }
$a_19 = { 554889e54883ec20897dfc488975f089 }
$a_20 = { 554889e5534881ec7814000089bd9ceb }
$a_21 = { 554889e5534883ec1848897de8488975 }
$a_22 = { 554889e54883ec1048897df8eb17488b }
$a_23 = { 554889e5534881ec3801000089bddcfe }
$a_24 = { 554889e5534881ecf819000089bd0ce6 }
$a_25 = { 554889e57412b8000000004885c07408 }
$a_26 = { 554889e5534881ec28040000e8d0faff }
$a_27 = { 554889e5534881ec2804000089bdecfb }
$a_28 = { 554889e5534881ecb814000089bd6ceb }
$a_29 = { 554889e54883ec1048897df8488975f0 }
$a_30 = { 554889e5534883ec28897dec488975e0 }
condition:
24 of them
}
rule BackdoorLinuxTurla_5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8 {
strings:
$a_2 = { 5589e583ec1c897dfc8b7d088975f889 }
$a_3 = { 558bb560ffffff8b9d48ffffff85f60f }
$a_4 = { 5589e58d45f883ec1089442404c70424 }
$a_5 = { 5589e5575689c68d45e45383ec2c8955 }
$a_6 = { 5589e55789cf565383ec2489c38955e4 }
$a_7 = { 5589e5565383ec1c8b5d08803b000f89 }
$a_8 = { 5589e557565383ec048b7d0cc745f000 }
$a_9 = { 5589e583ec108b451085c07423894424 }
$a_10 = { 5589e583ec048b4508890424e86f4a00 }
$a_11 = { 5589e583ec10895dfc8b5d08837b38ff }
$a_12 = { 5589e583ec10895df88b4d108b5d0c89 }
$a_13 = { 5589e557565383ec108b550c8b450885 }
$a_14 = { 5589e557565383ec1c8b7508f6460120 }
$a_15 = { 5589e583ec40897dfc8b15381410088b }
$a_16 = { 5589e58b4d088b510483c2308d742600 }
$a_17 = { 5589e557565381ec140400008b7d088b }
$a_18 = { 5589e583ec18a198600f0885c0750489 }
$a_19 = { 5589e583ec1c895df48b5d088975f88b }
$a_20 = { 5589e557565383ec288b3db09b0f0889 }
$a_21 = { 5589e58b55085d891510900e08c389f6 }
$a_22 = { 558b15700c0f0889e585d27e09b82f00 }
$a_23 = { 5589e55631f65383ec1c8b15000b0f08 }
$a_24 = { 558b330fb65e0cf6c301744a8b45108b }
$a_25 = { 5589e5575653bb0000000083ec5c8965 }
$a_26 = { 5589e557565383ec548b5d088945dc89 }
$a_27 = { 5589e583ec1c895df48b5d088975f889 }
$a_28 = { 5589e5565383ec048b1d8c9c0f0885db }
$a_29 = { 5589e557565383ec24c745ec00000000 }
$a_30 = { 5589e55731ff5689d65383ec148b5814 }
condition:
24 of them
}
rule BackdoorMacOSXSabPab_c3f32ba569ce3b3c8901d1bb537363317df36c42557e6a5ee4e07fd8ee7956a9 {
strings:
$a_2 = { 5589e557565381ec1c060000e8000000 }
$a_3 = { 5589e55383ec44e8000000005b8b450c }
$a_4 = { 5589e583ec188b4508668945f40fb745 }
$a_5 = { 5589e557565383ec5ce8000000005b8b }
$a_6 = { 5589e55383ec34e8000000005be8b523 }
$a_7 = { 5589e55383ec44e8000000005b8d834c }
$a_8 = { 5589e5575683ec308b450c668945e48b }
$a_9 = { 5589e5575381ece0040000e800000000 }
$a_10 = { 5589e5575381ec401f0000e800000000 }
$a_11 = { 5589e5575381ec70040000e800000000 }
$a_12 = { 5589e5575383ec70e8000000005b8b45 }
$a_13 = { 5589e583ec38c745e0000000008b4510 }
$a_14 = { 5589e583ec188b4510c60000c745f001 }
$a_15 = { 5589e557565381ec6c040000e8000000 }
$a_16 = { 5589e557565381ec6c010000e8000000 }
$a_17 = { 5589e583ec38837d0cff750cc745e4ff }
$a_18 = { 558b45d0f76dd489d18b45d4c1f81f89 }
$a_19 = { 5589e55383ec24e8000000005b8b4508 }
$a_20 = { 5589e55381ecd4040000e8000000005b }
$a_21 = { 5589e5575383ec60e8000000005b837d }
$a_22 = { 5589e5575683ec208b450c890424e860 }
$a_23 = { 5589e55383ec74e8000000005b837d10 }
$a_24 = { 5589e55381ec94000000e8000000005b }
$a_25 = { 5589e583ec28e8962700008945f4c744 }
$a_26 = { 5589e583ec38e84ffdffff8945f0837d }
$a_27 = { 5589e55383ec44e8000000005b8b550c }
$a_28 = { 5589e55383ec34e8000000005b8b450c }
$a_29 = { 5589e557565381ec9c000000e8000000 }
$a_30 = { 5589e55383ec44e8000000005b8b4508 }
condition:
24 of them
}
rule BackdoorMSILBladabindi_00d4bc6e5591439edba5b9ffcd524c5400bcf13a82fe1438b723d3b7c95ba08f {
strings:
$a_2 = { 558bec83c4f8e84167f7ff8855fb8945 }
$a_3 = { 558bec51538945fc8b45fc83c020508b }
$a_4 = { 558b45f00145f47105e8ba44fcffeb46 }
$a_5 = { 558bec518945fc8b45fc83b8a4000000 }
$a_6 = { 558bec83c4f8538945fc8b45fce86ed3 }
$a_7 = { 558bec83c4e833d28955f48955ec8945 }
$a_8 = { 558bec518b550c8b45088b00e8c39efa }
$a_9 = { 558bec83c4f88855fb8945fc8b45fc83 }
$a_10 = { 558b45f0508b45f88b4038058e4379a6 }
$a_11 = { 558bec83c4f48955f88945fcbab00348 }
$a_12 = { 558bec83c4f4668955fa8945fc8b45fc }
$a_13 = { 558becb9eb0000006a006a004975f951 }
$a_14 = { 558bec83c4f88955f88945fc8b45f850 }
$a_15 = { 558b45f0508b45f88b401805134630a8 }
$a_16 = { 558b45ec508b45f88b0005fa27a1ea50 }
$a_17 = { 558bec51538bd868ffff00008bcaa160 }
$a_18 = { 558bec33c055683909480064ff306489 }
$a_19 = { 558bec51538945fc8b45fc83c022508b }
$a_20 = { 558b45e8508b45f88b4020054f7ea86f }
$a_21 = { 558bec33c05568f2f9450064ff306489 }
$a_22 = { 558bec83c4e88945fc8b45fc8b10ff12 }
$a_23 = { 558bec83c4e48955f88945fc6a03c745 }
$a_24 = { 5589e5c9c39090908d4c240483e4f0ff }
$a_25 = { 558bec51ba2c794400a15c8e5300e835 }
$a_26 = { 558bec83c4d453565733c9894dd88955 }
$a_27 = { 558bec83c4f8e8c15bfbff8855fb8945 }
$a_28 = { 558bec83c4a433c08945fc33c0556806 }
$a_29 = { 558bec83c4f8538855fb8945fc6a2033 }
$a_30 = { 558ba872ce15922599dd4e19972720e7 }
condition:
24 of them
}
rule BackdoorMSILCorinrat_1ea1c1f5cc55bb9b89304d55f1bfa17196a8808b8620ff3a6c7886e7669c6a96 {
strings:
$a_2 = { 558bec83fe287a00fb770cff7508e89b }
$a_3 = { 558b401cff35dca041008b7010e887d7 }
$a_4 = { 558bec83ec30682c130410e83e4bffff }
$a_5 = { 558beca1e0fd490083ec24c717deef49 }
$a_6 = { 558becff7508e8f40612025d87c07405 }
$a_7 = { 558bec568b751085f67429538b5d0c51 }
$a_8 = { 558bec6a006a0068de7810f06800eafe }
$a_9 = { 558bec83ec3856576a255e6e675d6e5e }
$a_10 = { 558bec568b75085756e8ac0000004f89 }
$a_11 = { 558bec83ec0c53565733dba8d11541d7 }
$a_12 = { 558bec5dfdb9e9fdfb578becff7508ec }
$a_13 = { 558bec83f8524154536825586a735e78 }
$a_14 = { 558bec81ec50020000515447680eea3d }
$a_15 = { 558bec8b4d108b550cf7d1568b650af9 }
$a_16 = { 558beceb711ce8f0f9ffff5985c07502 }
$a_17 = { 558bec5151833d70b94900000f841f07 }
$a_18 = { 558bea8d551281c27517ff750c2d4304 }
$a_19 = { 558bec56ff650eef750c6a48544100e8 }
$a_20 = { 558bec83ec0c53569d751e578f7f0856 }
$a_21 = { 558bec83e8920004025657e8c4090000 }
$a_22 = { 558bec515156578b7d0868607e4100f9 }
$a_23 = { 558bec6a006a0068ff8bf6fb6e0be87d }
$a_24 = { 558bec83ec206a2a586a2e648951f45c }
$a_25 = { 558bec83ec1853426a058f45fc33db50 }
$a_26 = { 558bec83ec1c5633f68975f48975eeee }
$a_27 = { 558bec8b4d0c83d9741331d28bc16639 }
$a_28 = { 558bec85ecb2000402535733db53556c }
$a_29 = { 558bec8b59169b571081ec3c5785c97a }
$a_30 = { 558be8816f0a04761c5633f6565668df }
condition:
24 of them
}
rule BackdoorMSILDalatar_19fed3675cac656d729600e42023bf54f42bd40ac91ac7432d8072b50b4c5fcc {
strings:
$a_2 = { 558ba573cdfc0d7b8fed14f5ee92ab87 }
$a_3 = { 558b52acb3dcdfe410d67172fa6bdb35 }
$a_4 = { 558b5edabe6dfb422b4d963b8c491a50 }
$a_5 = { 558bf2ce643dcba5f103a1e811704eb1 }
$a_6 = { 558b01d6396f385b2e985d9c60fc3580 }
$a_7 = { 558b2aeadb9f827c887b45ca8b434a2b }
$a_8 = { 558bde434cf0aeac19b0f4b0eaba982c }
$a_9 = { 558b729bdab87aa37bc5a14bfdabe9d4 }
$a_10 = { 558b41f29ea70972e6565012469c42ba }
$a_11 = { 558baa4cbbea5fb8ce593b0e41565ea9 }
$a_12 = { 558b0e350205bcec30b2f28f15ac323c }
$a_13 = { 558bb156c1cd0af989efd2366d882955 }
$a_14 = { 558b1a36530163600c72bfd966c36810 }
$a_15 = { 558b56968a6f334746ee001bb7e85baf }
$a_16 = { 558b49b33e828345fc42176982abb06c }
$a_17 = { 558b4c56784766a32bee69c829d75706 }
$a_18 = { 558b1cd63d4a43a0f1d92383a7ef587a }
$a_19 = { 558b91256366200fe31c0ce222fbc20e }
$a_20 = { 558b491dde6f2de812f5d3e91042bd9d }
$a_21 = { 558b7bf15d0a231cbcafef1267798c74 }
$a_22 = { 558b985220df8a7469f5a9c734531d61 }
$a_23 = { 558b986633717ebd76b527b7a7b8a7be }
$a_24 = { 558b34052582defaba547edda3df0840 }
$a_25 = { 558bbed529ca06d6c6bc0725e0b6bc7a }
$a_26 = { 558b5c324458a4bc55c2d879728ff50a }
$a_27 = { 558b19fd8cee29da1886b9f47dfce70e }
$a_28 = { 558b76060eabd04bf7d6eca79d3e5061 }
$a_29 = { 558bbc9b68fb42a2599e4c233a3b32f8 }
$a_30 = { 558b5cc7725c2c91eab7b6773c819718 }
condition:
24 of them
}
rule BackdoorMSILDraliz_048c75bd510f5d85774f9da0d8fb5fc337e7b16c25468ff32c1c2667b3a38b76 {
strings:
$a_2 = { 558bd8601aba3921132624c96a1467ab }
$a_3 = { 558b5505f6143cb6e3c21c89cbb81da9 }
condition:
2 of them
}
rule BackdoorMSILFirsot_c4aae35fa55731370896d91dd2f00b97f7ea8cf0491f78943f90b969a268ba1e {
strings:
$a_2 = { 558b3e5cefc83c3aaf98d21faa999c90 }
$a_3 = { 558b5e9b757fa3e1cdff1bd556886c05 }
$a_4 = { 558bb9cc70dc812c060e8619ca731798 }
$a_5 = { 558bd153b9d274f16dcee3736a950e91 }
$a_6 = { 558bb934286caf8220e1f98674b34254 }
$a_7 = { 558bf29d6b0560157469bc1fed2dc255 }
$a_8 = { 558b568965c4f3627e21e3b3495c28f6 }
$a_9 = { 558b18d9c9f2eb7d70893539b93602ca }
$a_10 = { 558b0d14db2abee34bf2302e6083184a }
$a_11 = { 558bd119d3eb46a5bcf0f6f701e72a09 }
$a_12 = { 558b72df819fc4cf92b9270beb3d21bb }
$a_13 = { 558bbaf307dacd58b1f2db7b5b3236ee }
$a_14 = { 558b0f240e18e52cf52e63358680effe }
$a_15 = { 558b15830011cd06af67a25d4e47fa04 }
$a_16 = { 558b721747d99a590cb4f4b3b89a3cc1 }
$a_17 = { 558b13bdff1f41e91f16ee3cec636a9c }
$a_18 = { 558b9a266bb54c5884bff330da91e063 }
$a_19 = { 558b76c8fad5b524ffb00a142dfaaa08 }
$a_20 = { 558b4e95d0e9a8553eaf79a26d1564de }
$a_21 = { 558b8fd4ad6f7fe7c8fc4b67c29ff094 }
$a_22 = { 558b135038a961a468d7eb0fc258be7f }
$a_23 = { 558b1e8294ace89a5a5a267af2edce9c }
$a_24 = { 558bf1e4cc533e811964d7939dae0079 }
$a_25 = { 558b6694c196015c62e7d413c810c08c }
$a_26 = { 558b522dc948e8bae55cb91ebdb9681f }
$a_27 = { 558b81d2974dd373537f8a12e1932450 }
$a_28 = { 558b86cbc39a400b22c884d7b7e02395 }
$a_29 = { 558b3aac2e05c21a087efcdfa8ceb35d }
$a_30 = { 558b6280ccb818ef3db74d7cc08fe77b }
condition:
24 of them
}
rule BackdoorMSILFynloski_f45ce10220eef4eb1f22d58a167d3ffd0f7917497c644773b0719f3911f298cd {
strings:
$a_2 = { 558bc34110fe4997063f191002c1eb18 }
$a_3 = { 558b0b64481eac1f0214803c41329100 }
$a_4 = { 558bf0c46fb81e10f32b884e83c60481 }
$a_5 = { 558b70fb9ec1e5d35d4a1c9ebdf56529 }
$a_6 = { 558bc705ce91c0b3dfdb07720c050744 }
$a_7 = { 558b5457c657bcbfaa7a2c425a57d523 }
$a_8 = { 558bd8ac1e3006036fb3215f0c17b027 }
$a_9 = { 558bcad038dbfdf77b9cb9e01e2bcb89 }
$a_10 = { 558bec531018e0076894dc654875608b }
$a_11 = { 558b48d31699fe3f533ce4f8664fdab3 }
$a_12 = { 558bfb5482b0924c31a8b868c908d707 }
$a_13 = { 558bfd66a34f1bd5d248398406822f03 }
$a_14 = { 558bc573f5362947216a49be5406ff8e }
$a_15 = { 558bd79514291fb803dbfcb591d18fe3 }
$a_16 = { 558bccc3727422067f02f03b150c6a14 }
condition:
13 of them
}
rule BackdoorMSILGataspi_32342bb2a1f293c2f3dca2d8da8bb5d36129396987ab61d27357d324cf04b483 {
strings:
$a_2 = { 558bec83c4f8538bda33c05568a01542 }
$a_3 = { 558bf28bd88bc6e8b1c6ffff8bf88bc3 }
$a_4 = { 558bec6a0033c05568da0a410064ff30 }
$a_5 = { 558bec51538bda8945fc8b45fc8b8040 }
$a_6 = { 558bec6a0033c05568f6e0400064ff30 }
$a_7 = { 558bec83c4c053565733c9894df0894d }
$a_8 = { 558bda8be8c64524018b45048b40043b }
$a_9 = { 558bec538bd833c08943248b45088943 }
$a_10 = { 558bf833ed8b87a00100008b70084e85 }
$a_11 = { 558bec83c4e0538945fc8b45fc8b4028 }
$a_12 = { 558bec5153884dff6683786e0074188a }
$a_13 = { 558b2461137603056e4f4279e2b1ab49 }
$a_14 = { 558bec33c0556851dd430064ff306489 }
$a_15 = { 558bec83c4a853565733c9894da88bda }
$a_16 = { 558bec33c0556878ae420064ff306489 }
$a_17 = { 558bec53568b750883c6fc33db8b06ba }
$a_18 = { 558bec33d28ad08b450883c0f8e88e92 }
$a_19 = { 558bec535684d2740883c4f0e85bfaf8 }
$a_20 = { 558bec33c05568e5ff410064ff306489 }
$a_21 = { 558bd38b45ece8568dfbffe8f5faffff }
$a_22 = { 558bec83c4ec535633c08945fc8b5d08 }
$a_23 = { 558bec8b55088b450c8b4d10e8a315f8 }
$a_24 = { 558bfa8bd88b77088b8318010000f7d8 }
$a_25 = { 558bec83c4f853568855fb8945fc8b45 }
$a_26 = { 558b24353a2c2cbf8c80631b495fa3d2 }
$a_27 = { 558b45fc8b4018e86df6ffff59eb0d55 }
$a_28 = { 558bec536a008b5d0853515250e8d2f9 }
$a_29 = { 558bec83c4f853bbfcd64b00e84741fd }
$a_30 = { 558bec6a00538bd833c05568d0024800 }
condition:
24 of them
}
rule BackdoorMSILGeravib_4e22fbd1dc53414b55e26605c611e45723b92ef9b82387b20f88384da11f52a5 {
strings:
$a_2 = { 558b83cef8c08cb66d7a4b19a639b53d }
$a_3 = { 558b0ed3d519193159c793d3b597e89f }
$a_4 = { 558b9d8364e74c62cc8872dc44d422e9 }
$a_5 = { 558b4c5741f201a944b44a4cc9afc27d }
$a_6 = { 558b92f0dea204996b8ac2c862047642 }
$a_7 = { 558be6b6adfe506ac4dc0598552e26ec }
condition:
6 of them
}
rule BackdoorMSILGetob_8bb00be4e25a15ec2034774875f9c938b9894773b832f4b86f4002a5d824fb08 {
strings:
$a_2 = { 558b3394a7bb1e9c787f04d4f44a6a31 }
condition:
2 of them
}
rule BackdoorMSILMinerbot_b5768140606674793013c4e7326438681e13b0f7b9eac740283dcd20a46faa5f {
strings:
$a_2 = { 558bbf7745c125d3d62fc2691cef5bf3 }
$a_3 = { 558b440f631621fc1c05108e70a8b900 }
$a_4 = { 558b11fd9e8cd76ccac7408f35a257d5 }
$a_5 = { 558b31caece8fef2955dba3177fb862d }
$a_6 = { 558b7edd9c7352c72822049f55043b1b }
$a_7 = { 558b5efdbb4684f832b0194b494ecbef }
$a_8 = { 558b38f861b71ab749e7f73bea283c29 }
$a_9 = { 5589e5505351568b75088b4d0cc1e902 }
$a_10 = { 558bcaaf4abf65abae3323ef4e14c868 }
$a_11 = { 558b4bf18025fd1ebcda45945760cfc1 }
$a_12 = { 558b0155c2745cbbe28b0bdef42e5159 }
$a_13 = { 558bcb32596a39c5ab25fe8e022d3689 }
$a_14 = { 558b434bed04e4842fef331c1fc9f72d }
$a_15 = { 558b4a5c1ee9d5ba0555d19d69798bb5 }
$a_16 = { 558b71ef053a7d1082fd8846487fa9d8 }
$a_17 = { 558b2f080ca0682e3894593b604b82c1 }
$a_18 = { 558bb3591f245b2d1803ebc50ae10522 }
$a_19 = { 558bc856c252090609ecd1a7428b3092 }
$a_20 = { 558bfb50594c9a6190a601e66a05fc5f }
$a_21 = { 558b9059a649f89a954ef7252b3bffe2 }
$a_22 = { 558b717531702dfe66aab5e69116fa21 }
condition:
18 of them
}
rule BackdoorMSILMinerbot_f3bbf13ccf5b9276d5fe7056b17385bee69862a01cead757b7c35a0dcab4324d {
strings:
$a_2 = { 558bbbbb22228888555bbc88ccbbb222 }
$a_3 = { 558bfc860a8939d32a87582defdc1352 }
$a_4 = { 558bbbbbb555fffbbb2bbb25bbbb8555 }
$a_5 = { 558bbbbb555559999992222555999555 }
$a_6 = { 558b0f0ab3c9af26a026309fe79bb570 }
$a_7 = { 558bdbcce5974645977435c2f22770ed }
$a_8 = { 558bbbbb22225555555bbf8855bbbccc }
$a_9 = { 558bbc22ccc5555555bbbbbccccccccc }
$a_10 = { 558bbbbcccc559999999995588888bbc }
$a_11 = { 558ba594a5252c056279d69152fcad65 }
$a_12 = { 558bbbbb55555522222bbb25bbbb8555 }
$a_13 = { 558bbb2bb88822222bbbbb555bc99922 }
$a_14 = { 558b2d1a54b9ad58c78f5473bb79aa45 }
$a_15 = { 558b74f72d019adb3a4df507352d3000 }
$a_16 = { 558bb22255bbbb2555555fc8cccbc995 }
$a_17 = { 558bbb555558bbbbb98888888899999c }
$a_18 = { 558bbbbbb88228222bbbbb555999999b }
$a_19 = { 558bbbbbbbbf22555bbb299b88b555ff }
$a_20 = { 558b8ef376844c5c6304a37ebf1d83f2 }
$a_21 = { 558b10b0e20771faf3ad1101e63a02ee }
$a_22 = { 558bfffff2225fff555bbf8855bbbccc }
$a_23 = { 558b71d05f1627aa0e7d19785657f36e }
$a_24 = { 558bb0d9ce4977b00eef7ea43a9554d1 }
$a_25 = { 5589e5505351568b75088b4d0cc1e902 }
$a_26 = { 558b6189bcae9c6567b034d1fdaf4114 }
$a_27 = { 558bea0873880bc71cc4c4446b8a4b18 }
$a_28 = { 558b4e59d1473bf2ea59e932f07bf698 }
$a_29 = { 558bbbbbb55cc855bbbbbb59ccc9999b }
$a_30 = { 558b2a4fbcba271a30f7f77212e6e76c }
condition:
24 of them
}
rule BackdoorMSILNoancooe_5d15b5ad7e0b93272e39747573d5e8c666dd4057c688553e58fb333f74827677 {
strings:
$a_2 = { 558bc5c8e8fe453a5036e7444d698aec }
condition:
2 of them
}
rule BackdoorMSILNoancooe_cfe04c09e1ff03e9b4320aa78c8b84beb519a67192100db67f1d793919243b5a {
strings:
$a_2 = { 558bc74d2ab33f01e394344d252f368c }
$a_3 = { 558beedf05278896ad728078e410b81e }
$a_4 = { 558bdd588b77d3f44e53793d95ad6e61 }
condition:
3 of them
}
rule BackdoorMSILOmaneat_dc462ccfc4cccd023f26b8e62b94d44d514dac199c185a0799a749c4759fdc9b {
strings:
$a_2 = { 558b8b2adfa8c30f0ea20254e290da16 }
condition:
2 of them
}
rule BackdoorMSILOrcus_4163e40a0d2dae2fef5183fb4a87597431cc4e6808ce92a6b02f630f32d34c76 {
strings:
$a_2 = { 558be5c8e4f209716b673c592c006659 }
$a_3 = { 558bfdcd99849085df5b1b71e570a011 }
$a_4 = { 558b3a102faf6261ef5ea1038d85267f }
$a_5 = { 558bf7fe2939dd78422c3c02e064ffdd }
$a_6 = { 558bd00f3163cbcb36592d98ee310ec6 }
$a_7 = { 558bb8010079b5f79929c4ade40e56a7 }
$a_8 = { 558b65c94720382b259381eb6c16209f }
$a_9 = { 558b6babb133d4c748f969a90b9ebc67 }
$a_10 = { 558b00a479386f8006f053bf6c805b26 }
$a_11 = { 558b73a65e370b98ea758c82f4ddf5b8 }
$a_12 = { 558b7434a41853ad6284f1e41c67f999 }
$a_13 = { 5589e583ecdc57e8dc2b015f81ef7871 }
$a_14 = { 558bd30e27016158f966ad18b06576a9 }
$a_15 = { 558b616897844cafe44301e76b17cae8 }
$a_16 = { 558b15ce5169fca4ce9e50a0822817b4 }
$a_17 = { 558be41209c2b70ab29af7012abd0330 }
$a_18 = { 558bf9db23c00d81a1ae902829c51734 }
$a_19 = { 558be185a677ee9f628fd220a4151e32 }
$a_20 = { 558bd606d1a0045070921830ec514807 }
$a_21 = { 558b9695281f06ab9cad316355958176 }
$a_22 = { 5589e5505351568b75088b4d0cc1e902 }
$a_23 = { 558be97ca2bccc57a81f95a9d9485416 }
$a_24 = { 558b033668ab9e754e488f5526c6d1cc }
$a_25 = { 5589e581c5ab4ab4082c256c4a04b4e5 }
$a_26 = { 558b0015cec569e04ef4d700fcaf2402 }
condition:
21 of them
}
rule BackdoorMSILOrcusrot_2b3dfde1dde3ec6f16a75cd7d45b92f5f997c6af4d8982e998c7103e543b6b02 {
strings:
$a_2 = { 558b25c8f7cbb2d943166531f7b59be7 }
$a_3 = { 558b3a3fbcfd2641fc5475a2713fa0ea }
$a_4 = { 558b6be4ee9bc09ca3ceed8a0aa488bc }
$a_5 = { 558bb58eb2ab99bdcf8aca147c43a460 }
$a_6 = { 558bb85d25008d1cd9f3a6d9282ca8e9 }
$a_7 = { 558b7bd7d59e216a372d11cb6f799ffd }
$a_8 = { 558b6b26b5e0176a88a13a5b5543dafc }
$a_9 = { 558b9b8b0e569d9ddcc39075b313f5ed }
condition:
7 of them
}
rule BackdoorMSILSisbot_0fd09cfe0eddc93bce0182924c5a577f622b048d039b36f42c90f20cd688d1f7 {
strings:
$a_2 = { 558b1c528b1c52ac6a388b1a8e28b172 }
$a_3 = { 558b92916858471f94a91a8e2558b92a }
$a_4 = { 558b1d65584f0f0558c7ad6b30c15626 }
$a_5 = { 558b84a46a381562e12ac6a381562c70 }
$a_6 = { 558b9290c9562e4a43094865690ca522 }
$a_7 = { 558b1c529170956351c058d4702a46a3 }
$a_8 = { 558b92ac58e294860a45c956351c7e50 }
$a_9 = { 558b92ac6b2956264a45c9562e52aae4 }
$a_10 = { 558b1c4a46a382558d4704a46b095635 }
$a_11 = { 558b8f0522e02182ac5c148612917055 }
$a_12 = { 558b9291729562e4ab1638a558b92ac5 }
$a_13 = { 558b1c12ac5c14864a45ca558b92ac58 }
$a_14 = { 558b9290c9562e52ac5c8b1729562e52 }
$a_15 = { 558b1d456b9e57d710956263f0ab0f59 }
$a_16 = { 558b1c7c156351c1162c702ac58e28b1 }
$a_17 = { 558b84ab170522c704ab1638948b94ab }
$a_18 = { 558b94ab173e0a45c148b94ab170522e }
$a_19 = { 558b92ac329562e4ab172522e52b5172 }
$a_20 = { 558b8291a8e02c5c2558d60a778b1c12 }
condition:
16 of them
}
rule BackdoorMSILSplori_bf03b45106c15f35e95b8f5daff6a258306bef33b69b45b690b2a9dfd3c94386 {
strings:
$a_2 = { 558b929f9bf8cdf392ffc87c750f2f4b }
$a_3 = { 558b3e688d8386d699187749e3e8dc68 }
$a_4 = { 558b7a89d893d738500000007e7d837a }
condition:
3 of them
}
rule BackdoorMSILSymratek_b3ca1a1da2d0be59d20f0bd3d7475da42f835ab423a865d05791270795356028 {
strings:
$a_2 = { 558b6095ba70ac7fcb21ee96f3d2cfd0 }
$a_3 = { 558b645c3699426fc1532a6a3ab84367 }
$a_4 = { 558be538f4cd008d2be12e72fd343895 }
$a_5 = { 558bebbd3194bf6aa30a7c297b3004b6 }
$a_6 = { 5589e52f1e066a0e869ea1e70d80d1dc }
$a_7 = { 558be667235cfd71518de00138d024b7 }
$a_8 = { 558b2474f08f7774ae46c587b4381cd8 }
condition:
6 of them
}
rule BackdoorMSILTelebot_d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac {
strings:
$a_2 = { 558b020000000100f432020000000100 }
condition:
2 of them
}
rule BackdoorPHPB374kshell_7feab00a6048bd8405008170a3cfb8075dce859b5c820f9ca532555dd259557e {
strings:
$a_2 = { 558b7a54adef9dbe2def6e4b5ae04594 }
condition:
2 of them
}
rule BackdoorVBSQakbot_75dae5f997eee623dae3cb59edd66d7f5ec31f49cbf386f0245d5edab304d3ff {
strings:
$a_2 = { 5589e583e4f883ec10f30f1005304000 }
$a_3 = { 5589e583e4f883ec08e8d2faffff8b40 }
$a_4 = { 5589e583e4f883ec188b450831c98944 }
$a_5 = { 5589e553575683e4f883ec488b450c8b }
$a_6 = { 5589e553575683e4f883ec488d05b02d }
$a_7 = { 5589e553575683e4f881ec880000008d }
$a_8 = { 5589e553575683e4f883ec608b450c8b }
$a_9 = { 5589e553575683e4f881ec880000008b }
$a_10 = { 558b682ceff209110b187c75086198b9 }
$a_11 = { 558bd52e657488c54ef127e9c24b2d0c }
$a_12 = { 5589e55683e4f883ec688b450c8b4d08 }
$a_13 = { 5589e553575683e4f883ec308b45108b }
$a_14 = { 5589e583e4f883ec18c7442414a56915 }
$a_15 = { 5589e553575683e4f881eca80000008b }
$a_16 = { 5589e553575683e4f881eca00000008d }
$a_17 = { 5589e553575683e4f883ec28b8feffff }
$a_18 = { 5589e5575683e4f883ec188b45108b4d }
$a_19 = { 5589e583e4f883ec288b45088b4c241c }
$a_20 = { 5589e553575683e4f881eca00000008b }
$a_21 = { 5589e553575683e4f881ecd000000031 }
condition:
17 of them
}
rule BackdoorWin32Aebot_f549654c98c1a7783fa3c13176409284d53c749bafcd373351368f3f2bdcf4ee {
strings:
$a_2 = { 558bec515153568b35785d4200578b56 }
$a_3 = { 558bec81ec84000000568b75085733ff }
$a_4 = { 558bec83ec4456576a09be802d420059 }
$a_5 = { 558bec83ec388365fc00c745c8282742 }
$a_6 = { 558bec5356578b7d0857e837610000ff }
$a_7 = { 558bec81ec880000008d45fcc745f880 }
$a_8 = { 558bec81ecdc000000535657bed02742 }
$a_9 = { 558bec81ec1c0100005356578d85e4fe }
$a_10 = { 558bec81ec0008000056beff03000056 }
$a_11 = { 558bec51568b750885f6745aa1540643 }
$a_12 = { 558bec51833dc8f042000053751d8b45 }
$a_13 = { 558bec81ecb80500008b450853565733 }
$a_14 = { 558bec803decf0420000535674278b5d }
$a_15 = { 558b4524890da43942006bc03c034528 }
$a_16 = { 558bec81ec0c0200005357bf00010000 }
$a_17 = { 558becb860120000e8fa5a0000535657 }
$a_18 = { 558bec81ec80030000538b1d18a14100 }
$a_19 = { 558bec83ec0c53568b7508573b352006 }
$a_20 = { 558bec81ec04030000568d85fcfcffff }
$a_21 = { 558bec518365fc005657be80654200bf }
$a_22 = { 558bec81ec000d00008b4508538b1d18 }
$a_23 = { 558bec81ec04050000538b1d78a24100 }
$a_24 = { 558bec81eccc0000008d45f050ff155c }
$a_25 = { 558bec83ec2c56576a05bebc32420059 }
$a_26 = { 558bec81ec20070000535657bedc3342 }
$a_27 = { 558bec5657688c1c4200ff7508e83f63 }
$a_28 = { 558bec5657ff7508e8d52100008bf08d }
$a_29 = { 558bec81ec1802000053565733ff68fa }
$a_30 = { 558bec5153568b355c3d420057837e10 }
condition:
24 of them
}
rule BackdoorWin32Afbot_c3bccae52b4c5c96da47f5c8445d21f12498eaba8a884e1998cf5bc99f3da032 {
strings:
$a_2 = { 558bec505156578b750c8b7d088b4d10 }
$a_3 = { 558bec81c4a8f9ffff6853020000ff75 }
$a_4 = { 558bec81c4acf9ffff6853020000ff75 }
$a_5 = { 558bec81c490deffff6801010000ff75 }
$a_6 = { 558bec81c4eceeffff680a010000ff75 }
$a_7 = { 558bec81c4f0feffff52515657686e50 }
$a_8 = { 558bec81c400fcffff52515657687550 }
$a_9 = { 558bec81c454ffffff5053515657688d }
$a_10 = { 558bec56578b45088b7d0c0bc0743883 }
$a_11 = { 558bec81c44cfbffff5251565768a450 }
$a_12 = { 558bec51525657be5a8b400033c9eb37 }
$a_13 = { 558bec50515657b9000000008b750c8b }
$a_14 = { 558bec51525657be5a8b400033c9eb2e }
$a_15 = { 558bec81c440ffffff6a49ff75088d45 }
$a_16 = { 558bec575633c08b750833c933d28a06 }
$a_17 = { 558bec83c4fc505657e8ae27000033c9 }
$a_18 = { 558bec83c4fc50565768000400006864 }
$a_19 = { 558bec81c470ffffff8b451489857bff }
$a_20 = { 558bec83c4dc6a09ff75088d45f750e8 }
$a_21 = { 558bec81c4f8feffff68050100008d85 }
$a_22 = { 558bec81c464ffffff505156576a4fff }
$a_23 = { 558bec81c478ffffff51565768805340 }
$a_24 = { 558bec515657be5a8b400033c9eb3151 }
$a_25 = { 558bec81c404fcffff50525156576a00 }
$a_26 = { 558bec81c4fceeffff5053515657ff75 }
$a_27 = { 558bec81c44cf7ffff6a45ff75088d45 }
$a_28 = { 558bec81c4c0fdffff680e010000ff75 }
$a_29 = { 558bec81c400f8ffff50515657ff7510 }
$a_30 = { 558bec83c4fc5053515256578b7508bf }
condition:
24 of them
}
rule BackdoorWin32Afcore_e6644c7857e43a484eb5dda39e8d23af68f9179f0155438cbabcbed52776f06a {
strings:
$a_2 = { 558bec33c03905c8b901627449ff7508 }
$a_3 = { 558bec538b5d0cff336870e10162e82e }
$a_4 = { 558bec53568b5d0c8b7508ac0ac07406 }
$a_5 = { 558bec518b4d0ce31157b00a8b7d08f2 }
$a_6 = { 558becff750ce804000000c9c20800c8 }
$a_7 = { 558bec5051525356578b4d148b550c8b }
$a_8 = { 558bec8b5d0c687fb2016253ff7508e8 }
$a_9 = { 558bec578b7d08f70700010000751aff }
$a_10 = { 558bec83ec18535657e862a5ffff8945 }
$a_11 = { 558bec538b5d08f70304000000746583 }
$a_12 = { 558bec8b4d0cff71246870e10162e85b }
$a_13 = { 558becfc810d781a0262000008006a00 }
$a_14 = { 558bec8b4d0c8d914404000052ffb124 }
$a_15 = { 558bec5157b00083c9ff8b7d08f2aef7 }
$a_16 = { 558bec538b1d30d801620bdb0f84ad00 }
$a_17 = { 558bec515253578b5d0c8b7d08ff7304 }
$a_18 = { 558bec6a006a006a33ff7508e80b6e01 }
$a_19 = { 558bec6854b20162ff750cff7508e857 }
$a_20 = { 558bec515253578b7d08837d0c000f84 }
$a_21 = { 558bec837d10007465538b5d08f74314 }
$a_22 = { 558bec51568b4d0c8b75080bc9740f53 }
$a_23 = { 558bec5051528b4d0c83e90cff7104ff }
$a_24 = { 558bec538b1de8d801620bdb0f84ca00 }
$a_25 = { 558bec8b0dccbc0162e335578b4508bf }
$a_26 = { 558bec833dacb00162007434515657b9 }
$a_27 = { 558bec5356578b7d08f787c800000000 }
$a_28 = { 558bec5356578b5d0c8b73088d7b0cc6 }
$a_29 = { 558bec515633c08bc88b7508eb0f2c30 }
$a_30 = { 558becfcc705d0c50162000000008b4d }
condition:
24 of them
}
rule BackdoorWin32Aimbot_7d8f5c0e968e5fb49ea9100352a6cbedc4c9d40c853b57494857560868faa26f {
strings:
$a_2 = { 558b120894accd6cb7e866adeb4d2601 }
$a_3 = { 558b4d5823c7d34d1868a971a7488c35 }
$a_4 = { 558bec83e420ec48535529f5348b0dbb }
condition:
3 of them
}
rule BackdoorWin32AimMaster_49991003f8102eb4de761725625ace309aef656885b659a1b616c839a3097b07 {
strings:
$a_2 = { 558bec515168961b400064a100000000 }
$a_3 = { 558bec83ec1868961b400064a1000000 }
$a_4 = { 558bec51565733ff897dfce85295ffff }
$a_5 = { 558bec83ec0c68961b400064a1000000 }
$a_6 = { 558bec83ec1468961b400064a1000000 }
condition:
5 of them
}
rule BackdoorWin32Alaveensee_d040efc859a7a4612a819170d06298a045c0e9da1c5026bf90f4ead2e59cd97a {
strings:
$a_2 = { 558bec81ecc4010000a180a64d0033c5 }
$a_3 = { 558bec83e4f86aff68e4fe4b0064a100 }
$a_4 = { 558b6c240885c975058d41015dc33bd1 }
$a_5 = { 558bec833d4495530000568b3508da4d }
$a_6 = { 558bcec6461000e859fdffff8b4e0880 }
$a_7 = { 558bac24ac010000807d200056577407 }
$a_8 = { 558bec83ec14a180a64d0033c58945fc }
$a_9 = { 558bec68e4474c00ff1578224c0085c0 }
$a_10 = { 558bec5151a180a64d0033c58945fca1 }
$a_11 = { 558bec83ec105333db538d4df0e8dd25 }
$a_12 = { 558b6c24105733ffc644241400897c24 }
$a_13 = { 558bcfe889fcffff85c07406ebd08b7c }
$a_14 = { 558bcfffd28b47048818016f048b4704 }
$a_15 = { 558bec83ec10ff75088d4df0e80f19ff }
$a_16 = { 558b6c2414885c2414391df43e53000f }
$a_17 = { 558bec83e4f86aff6818e84b0064a100 }
$a_18 = { 558b4c24308d0c8e894c242c3bf17352 }
$a_19 = { 558bcfffd08b4c24188b570480cb8088 }
$a_20 = { 558bec5de9960200008bff558bec8b45 }
$a_21 = { 558bec8b4508a328e34d005dc38bff55 }
$a_22 = { 558bec565733f6ff750cff7508e8fa9d }
$a_23 = { 558b6c2438568bf18b0dfcc04d00ba01 }
$a_24 = { 558bfbe86f0700008bc55f5e5d5b83c4 }
$a_25 = { 558bec83ec10ff750c8d4df0e856efff }
$a_26 = { 558b6c240c6a3a57e84c4c09008bd88b }
$a_27 = { 558bec8b4508c7404cf8304c008b4d08 }
$a_28 = { 558bec8b450883f8fe7518e8020e0000 }
$a_29 = { 558b6c24088b55083bfa7e09b8feffff }
$a_30 = { 558bec33c0668b4d08663b8848654c00 }
condition:
24 of them
}
rule BackdoorWin32Alcobot_81c45600d8171c9b529515d3c6c8a1ff99315817256832d7fbae324112780974 {
strings:
$a_2 = { 5589e551576a0068800000006a026a00 }
$a_3 = { 5589e581ecdc0300005356578dbd9cfe }
$a_4 = { 5589e581ec00040000578d7d1457ff75 }
$a_5 = { 5589e583ec2053565731db8b75086a11 }
$a_6 = { 5589e55657683f000f006a00ff7508e8 }
$a_7 = { 5589e551ff75086a016a00e8587a0000 }
$a_8 = { 5589e581ec7c010000535657c78538ff }
$a_9 = { 5589e583ec2c57c745e810000000e83c }
$a_10 = { 5589e5568b750883fe647c0531c040eb }
$a_11 = { 5589e583ec345356578365d8008b7508 }
$a_12 = { 5589e581ec0807000053565731db895d }
$a_13 = { 5589e583ec0c535657e89564000050e8 }
$a_14 = { 5589e55356578b750831ff89fbc1e307 }
$a_15 = { 5589e5b850010100e8ba250000535657 }
$a_16 = { 5589e5515768f7214400e85d73000089 }
$a_17 = { 5589e581ec00020000578d7d1057ff75 }
$a_18 = { 5589e581ec600800005356578b5d086a }
$a_19 = { 5589e55356578b5d0868e517440053e8 }
$a_20 = { 5589e583ec185356576a146a008d45e8 }
$a_21 = { 5589e556578b7d0809ff745e83ff407d }
$a_22 = { 5589e581eca0000000578b7d08688000 }
$a_23 = { 5589e581ec5c040000576a008d45fc50 }
$a_24 = { 5589e5b810150000e8c5610000535657 }
$a_25 = { 5589e5578b7d0869c7900200008d1405 }
$a_26 = { 5589e581ec1c0400005356578b5d1068 }
$a_27 = { 5589e55156578b75086a006a018d45ff }
$a_28 = { 5589e583ec145356578365fc0031db43 }
$a_29 = { 5589e581ec840900005356578365fc00 }
$a_30 = { 5589e55157e8b200000089c7803f2275 }
condition:
24 of them
}
rule BackdoorWin32Alcodor_f862ead5269c7964eff2eef137bdb8ff534c15a2c337736f0f6c659c7e3f251d {
strings:
$a_2 = { 558bec6aff682071400068f84f400064 }
$a_3 = { 558bec83ec588b4508538b5d0c5633f6 }
$a_4 = { 558bec6aff68e074400068f84f400064 }
$a_5 = { 558bec51518b4510530fb6550c8b0856 }
$a_6 = { 558bc18bf1c1f80583e61f8d3c8520eb }
$a_7 = { 558bec83ec24535633db5733f68b7d0c }
$a_8 = { 558bec0fb6450e0fb6550c8b4d088d84 }
$a_9 = { 558bec83ec14a1f8ea40008b15fcea40 }
$a_10 = { 558bec51833d24e6400000535657751d }
$a_11 = { 558bec51515333db391d48fc40005657 }
$a_12 = { 558bec6aff689874400068f84f400064 }
$a_13 = { 558bec83ec34538bd9565780bbe11000 }
$a_14 = { 558bec8b450885c075025dc3833d24e6 }
$a_15 = { 558b2de4704000565733db33f633ff3b }
$a_16 = { 558bec0fb6450f0fb6550d8b4d088d84 }
$a_17 = { 558bec83ec1453565733db6a18895dfc }
$a_18 = { 558bec83ec205356e8be1600008b5d10 }
$a_19 = { 558bec5657ff7508e8bc0e00008bf08d }
$a_20 = { 558bec81eca00100008d8560feffff57 }
$a_21 = { 558bec535657556a006a0068184f4000 }
$a_22 = { 558bec81ec60010000ff151c70400068 }
$a_23 = { 558bec83ec1853568b750857bfff0000 }
$a_24 = { 558bec81ecec03000053568b750857bf }
$a_25 = { 558bec568bf1578b7d08807e03007412 }
$a_26 = { 558bec83ec5453568bd933f68d45d857 }
$a_27 = { 558bec51ff7508e8ec15000085c08945 }
$a_28 = { 558bec83ec1c535657e8850100008bf0 }
condition:
22 of them
}
rule BackdoorWin32Amitis_b4c2ffccfe807167860d70ea95cde0390f2dc4220992d272497ced04afb97edd {
strings:
$a_2 = { 558bec81c48cfeffff33d289958cfeff }
$a_3 = { 558bec8b45088b40f4e8b20d0000a168 }
$a_4 = { 558bec81c498feffff5333c9898d98fe }
$a_5 = { 558bec83c4f4a118b84a00e8540affff }
$a_6 = { 558bec51535684d2740883c4f0e83a99 }
$a_7 = { 558bec6a006a005333c05568a9a74a00 }
$a_8 = { 558bec33c055683b2d470064ff306489 }
$a_9 = { 558bd6a110ec4a00e824320000e8532f }
$a_10 = { 558bec33c055686d80490064ff306489 }
$a_11 = { 558bec6a0053568bd833c05568e34a43 }
$a_12 = { 558bec53568bf18bd866a180ed440066 }
$a_13 = { 558bec83c4f053568955fc8bf033c089 }
$a_14 = { 558bec51538bd868ffff00008bcaa160 }
$a_15 = { 558bec53565733c05568b89c410064ff }
$a_16 = { 558bec83c4f8e8fd6afaff8855fb8945 }
$a_17 = { 558bec83c4f8538945fc8b45fce8feee }
$a_18 = { 558bec83c4f853bb0cec4a00e847cffa }
$a_19 = { 558bec33c05568dfa44a0064ff306489 }
$a_20 = { 558bec33c055688cb1460064ff306489 }
$a_21 = { 558bec51538bd86864ea4a00e8bb48fe }
$a_22 = { 558bec83c4c88d45c850a16cb84a00e8 }
$a_23 = { 558b45f88b40048bd6e8e8c4feffe81b }
$a_24 = { 558bec83c4ec8955f88945fc8b45fce8 }
$a_25 = { 558bec51538945fc8b45fce8fc90f8ff }
$a_26 = { 558bec33c9515151515333c0556837d3 }
$a_27 = { 558bec33c055685d79400064ff306489 }
$a_28 = { 558bec83c4f48955f88945fca1e8e94a }
$a_29 = { 558bd98bf28bf88bcb8bd68bc7e80f6d }
$a_30 = { 558bec53568b5d088d430450e867aeff }
condition:
24 of them
}
rule BackdoorWin32Ananlog_60b1984340119ce5d002ef877700be9e3cc621591e0d141fbfa7a69119da0281 {
strings:
$a_2 = { 558bd9dfc2a9e9a2b047e885d1f6f3c8 }
$a_3 = { 558bec81c4f4fbffff5657536a00e804 }
$a_4 = { 558bea332185b5b7c37fe1934c3ffb90 }
$a_5 = { 558bec5657538b75088bfe8b5d108b4d }
$a_6 = { 558bec83c4f86a0068800000006a026a }
condition:
5 of them
}
rule BackdoorWin32Androm_b7af2c969947bbebb0851ca3277060d1aa22f1cc6d4d66e22141abc6f08826a1 {
strings:
$a_2 = { 558b1b2915acee7b8738035fb359a0ca }
$a_3 = { 558bd11bdc015acefa75e05550400720 }
$a_4 = { 558b851009c782cb6d38e9442f4a5080 }
$a_5 = { 558ba89211194347b975e0c2aeccb305 }
$a_6 = { 558b4c0edfa22b070f9d8a95a19691b0 }
$a_7 = { 558bf0cdb4e7db4b589a867585078d2c }
$a_8 = { 558bdba64c70c19a95ebd5d478d08d9b }
$a_9 = { 558b9707c1bbf1d5de088dcb557b216f }
condition:
7 of them
}
rule BackdoorWin32Antilam_ba13136405d3b64cef0594aaa89339434b582f41f8b4db48e20765c0320ba708 {
strings:
$a_2 = { 558bec33c05568c517450064ff306489 }
$a_3 = { 558bec33c05568c1c9410064ff306489 }
$a_4 = { 558bec538b550833db891a33d2e80600 }
$a_5 = { 558bec6a00538bd833c0556829314300 }
$a_6 = { 558bec535657a128b64500e8a4a7ffff }
$a_7 = { 558bec83c4f853bbccb74500e85f27fc }
$a_8 = { 558bec8b80800000008b55088950788b }
$a_9 = { 558bec6a0033c05568c0b0400064ff30 }
$a_10 = { 558bec8b80800000008b55088950708b }
$a_11 = { 558bec833d24b7450000741a8b451450 }
$a_12 = { 558bec83c4e453568bda8bf0c745fc04 }
$a_13 = { 558bec83c4f85356578bda33c055680f }
$a_14 = { 558bec5356578b7d10803de3b6450000 }
$a_15 = { 558bec53803d2cb44500000f84cc0000 }
$a_16 = { 558bec33c05568a2d2400064ff306489 }
$a_17 = { 558bec83c4e45356578bf0a120b64500 }
$a_18 = { 558bec51832dc4b7450001734fb83ca3 }
$a_19 = { 558be868007f00006a00e8ee38fcff89 }
$a_20 = { 558bec515356578bd833c0a330b44500 }
$a_21 = { 558bec83c4f4b8cc864500e8e4dafaff }
$a_22 = { 558bec538bd866833db4b5450012753a }
$a_23 = { 558bec81c4d4fbffff5333c9898dd8fb }
$a_24 = { 558bec51535684d2740883c4f0e8f6dd }
$a_25 = { 558bec83c4f88955fc8945f855e832ff }
$a_26 = { 558bec51535684d2740883c4f0e8720f }
$a_27 = { 558bec6a006a0053568bf033c055681b }
$a_28 = { 558bec33c0556814b7440064ff306489 }
$a_29 = { 558bec51535684d2740883c4f0e8920a }
$a_30 = { 558bec6a006a00568bf033c055681fed }
condition:
24 of them
}
rule BackdoorWin32Ares_1a0e0215377d7173a479f3b54961687f71b1f1d8599f627c7d3a2b6b682187b7 {
strings:
$a_2 = { 558bec837d0c10750c6a00ff7508e855 }
$a_3 = { 558bec837d0c10750c6a00ff7508e81f }
$a_4 = { 558bec83c4b0c745d030000000c745d4 }
$a_5 = { 558bec837d0c10750c6a00ff7508e894 }
$a_6 = { 558bec837d0c10753bc605874e400030 }
$a_7 = { 558bec837d0c10750c6a00ff7508e8d3 }
$a_8 = { 558bec837d0c107511e8c21400006a00 }
$a_9 = { 558bec837d0c10750c6a00ff7508e8d7 }
condition:
7 of them
}
rule BackdoorWin32Assasin_c4e8e7b0d0a4f6d2e042d663766914c009358e3b498d85319dc527fa0d0e4d40 {
strings:
$a_2 = { 558bd9b3e860dfd8efc74304606a044f }
condition:
2 of them
}
rule BackdoorWin32Atadommoc_7938f79d9a89b978a8d8f6ab2b5f0f6c2df1e742b57286a759d7d7e89ceb0c19 {
strings:
$a_2 = { 558bec83ec08837d1001751aa19cb140 }
$a_3 = { 558bec51c745fc7c000000c745fc7c00 }
$a_4 = { 558bec83ec088b45088945f88b4df889 }
$a_5 = { 558bec8b4508c6000b5dc3cccccccccc }
$a_6 = { 558bec83ec08c745fc00000000c70574 }
$a_7 = { 558b8382ec5804d08a75dfb2bf57321c }
$a_8 = { 558bec8b45088b40fc5dc3cccccccccc }
$a_9 = { 558bec81ec50020000c785d4fdffff33 }
$a_10 = { 558bec51c745fc040000008b45fc050c }
$a_11 = { 558bec51c745fc2b020000c745fc2b02 }
$a_12 = { 558bec83ec10c745f804000000c745fc }
$a_13 = { 558b126c8a5e4ff2c203000000000000 }
$a_14 = { 558bec81ec5c040000535657c785b0fb }
$a_15 = { 558bec8b45088b4d080348048bc15dc3 }
$a_16 = { 558bec81ec1c010000c785ecfeffff7c }
$a_17 = { 558bec83ec088b45088378040074558b }
$a_18 = { 558bec837d0c017508a184b140008945 }
condition:
14 of them
}
rule BackdoorWin32Avosim_6e55e161dc9ace3076640a36ef4a8819bb85c6d5e88d8e852088478f79cf3b7c {
strings:
$a_2 = { 558beca1144042005685c07547394508 }
$a_3 = { 558bec807d0800752756be4842420083 }
$a_4 = { 558bec83ec20a10430420033c58945fc }
$a_5 = { 558becb810140000e8097f0000a10430 }
$a_6 = { 558beca1143d4200565783f8057c7c8b }
$a_7 = { 558bec83ec18a10430420033c58945fc }
$a_8 = { 558bec5151568bf1578b068b3857e858 }
$a_9 = { 558beca11440420085c074106a00ff75 }
$a_10 = { 558bec83ec10ff750c8d4df0e8bb01ff }
$a_11 = { 558bec83ec446a448d45bc6a0050e850 }
$a_12 = { 558bec566854b341006850b341006854 }
$a_13 = { 558bec6b45083805803042005dc38bff }
$a_14 = { 558bec51a10430420033c58945fc5668 }
$a_15 = { 558becb818100000e8394e0100a10430 }
$a_16 = { 558bec566880b34100687cb341006880 }
$a_17 = { 558bec81ec98000000a10430420033c5 }
$a_18 = { 558bec83ec1c8d4de453ff7510e8e153 }
$a_19 = { 558bec51a10430420033c58945fc578b }
$a_20 = { 558bec518b45088b0881f9a0c7410074 }
$a_21 = { 558bec51568b750856e8982f00005985 }
$a_22 = { 558bec83ec0cdd7dfcdbe2833d143d42 }
$a_23 = { 558bec837d08007507c605043d420001 }
$a_24 = { 558bec8b4508a30c4042005dc36a016a }
$a_25 = { 558bec5151568b750885f67514e8bf6c }
$a_26 = { 558bec5151a10430420033c58945fc83 }
$a_27 = { 558bec83ec30a10430420033c58945fc }
$a_28 = { 558bec568b750c8b063b052843420074 }
$a_29 = { 558bec8b450883c02050ff15d0b04100 }
$a_30 = { 558bec5de935020000566a02e81a9e00 }
condition:
24 of them
}
rule BackdoorWin32AXO_40c9cd2b546a1175fbb5360e93cc0a799488b4b4daacc8fb0255d0123802073a {
strings:
$a_2 = { 558bec6a005333c05568feeffa4464ff }
$a_3 = { 558bec51535684d2740883c4f0e87af3 }
$a_4 = { 558bec6a0053565733c05568bf450245 }
$a_5 = { 558bec51535684d2740883c4f0e8aa3d }
$a_6 = { 558bec83c4f853bb587b0245e853fefb }
$a_7 = { 558bec33c055685932004564ff306489 }
$a_8 = { 558bec6a00538bd833c055685a08fb44 }
$a_9 = { 558bec83c4f8535633c08945fca1f478 }
$a_10 = { 558bec33c95151515133c05568bfc7fb }
$a_11 = { 558bec6a00538bd833c05568c5d4fb44 }
$a_12 = { 558bec33c05568d8b1fc4464ff306489 }
$a_13 = { 558bec515356578945fc33c0556886f8 }
$a_14 = { 558b45d4e862fbffff5984c0744ca118 }
$a_15 = { 558bec33c0556881bafd4464ff306489 }
$a_16 = { 558bec51538955fc8bd88b45fce88ec6 }
$a_17 = { 558bec6a005356578bf833c05568849c }
$a_18 = { 558bec33c05568cd03014564ff306489 }
$a_19 = { 558bec33c05568f506014564ff306489 }
$a_20 = { 558bec6a00538bd833c05568e7950145 }
$a_21 = { 558b43045081c700bc00005755e8a1bc }
$a_22 = { 558bec6a0033c055680e27fc4464ff30 }
$a_23 = { 558bec6a00538bd833c055686588fd44 }
$a_24 = { 558bec33c05568c924014564ff306489 }
$a_25 = { 558bec515356578945fc833d74780245 }
$a_26 = { 558bec6a00538bd88b4514e8e44cf8ff }
$a_27 = { 558bec81c4a8f6ffff538945fc8b45fc }
$a_28 = { 558bec83c4f85356578bd8803dc47502 }
$a_29 = { 558bec33c05568b6c8fd4464ff306489 }
$a_30 = { 558bec6a00538bd88b4514e8984df8ff }
condition:
24 of them
}
rule BackdoorWin32Aybo_429fda1c1d2385b45ceefe83a5d36969e0656cdd29ade754598289c376fc7d97 {
strings:
$a_2 = { 558bec83c4e8538bd88d45e850e8d6be }
$a_3 = { 558bec83c4f8538945fc8b45fce802e5 }
$a_4 = { 558bec33c0556899f0400064ff306489 }
$a_5 = { 558bec6a005333c05568f50f460064ff }
$a_6 = { 558bec33c05568d9df420064ff306489 }
$a_7 = { 558bec83c4f8535657bf386646008b47 }
$a_8 = { 558bec83c4f88945fc8b45fce80beeff }
$a_9 = { 558bec33c05568d300440064ff306489 }
$a_10 = { 558bec33c05568d184400064ff306489 }
$a_11 = { 558bec51535657894dfc8bfa8bf0e8e9 }
$a_12 = { 558bec33c0556861f0400064ff306489 }
$a_13 = { 558bec83c4ec538bd8803dc465460000 }
$a_14 = { 558bec53568b45088b40fce864940000 }
$a_15 = { 558bec5153568bf06a006a006a076800 }
$a_16 = { 558bec6a00538bda33d25568a2ae4500 }
$a_17 = { 558b45f88b40048bd6e80ca10100e81b }
$a_18 = { 558bec833d106c460000740e8b450850 }
$a_19 = { 558bec5666bed2ffe8ef6afbff5e5dc2 }
$a_20 = { 558bec5153568bd88bc3e8bdebfaff8d }
$a_21 = { 558bec83c49c5356578bd86a0ee88aea }
$a_22 = { 558bec8b45088b400450e80d2100005d }
$a_23 = { 558bec51535657894dfc8bfa8bf0e891 }
$a_24 = { 558bea8bf08bc6e89992fdff8bf833db }
$a_25 = { 558bec33c05568f50d430064ff306489 }
$a_26 = { 558bec6a00538bd833c05568ea414100 }
$a_27 = { 558bec538bd88bc3e8d7e8feff506a00 }
$a_28 = { 558bec33c05568dd01410064ff306489 }
$a_29 = { 558bec5331db89c1dd4508d88ba04146 }
$a_30 = { 558beca1e46c4600e8abffffff33c055 }
condition:
24 of them
}
rule BackdoorWin32Babmote_13dd775879e41ce9541675d81909cf72368a952b912cd063e22025c20f5e1847 {
strings:
$a_2 = { 558bec81ec280000006808000000e8ff }
$a_3 = { 558b6c240c56576aff8b45008bb59c01 }
$a_4 = { 558bec83ec185356576a19e889350000 }
$a_5 = { 558b6c247456578b45008b5d088b7504 }
$a_6 = { 558b2d44d6490056578b7c24148bf157 }
$a_7 = { 558bec83ec6053568bf1578975f8e854 }
$a_8 = { 558bec81ec0c000000689c104a008b5d }
$a_9 = { 558bec5333db391d1c444d005657750f }
$a_10 = { 558bec81ec48000000c745fc00000000 }
$a_11 = { 558bcee8ee62feff8b6c2414892f8b0b }
$a_12 = { 558bec81ec100000006808000000e8a2 }
$a_13 = { 558bec81ec200000006818000000e89b }
$a_14 = { 558bec6aff68d89a4a0068ac2b480064 }
$a_15 = { 558bcee86a5402005f5e5d5b83c41cc2 }
$a_16 = { 558bcee817fdffff8b5e1c8bcee8cfba }
$a_17 = { 558bec5151568bf1578b3d34d149008b }
$a_18 = { 558bec5153568bf1578b4e688d86d800 }
$a_19 = { 558bec81ec24000000c745fc00000000 }
$a_20 = { 558bec81ec5c000000c745fc00000000 }
$a_21 = { 558bcbe807ffffff5e5d5bc204008b4b }
$a_22 = { 558bac24940100008b88c80100005657 }
$a_23 = { 558bec6aff68b0b6490064a100000000 }
$a_24 = { 558b6c240c56578b7c241c8b450481ff }
$a_25 = { 558bec81ec0c000000837d08010f8c11 }
$a_26 = { 558bc8ff929000000085c075953b7424 }
$a_27 = { 558bec81ec28000000837d10000f8508 }
$a_28 = { 558bcee83078ffff8b4c24248b542420 }
$a_29 = { 558bec6aff6860a24a0068ac2b480064 }
$a_30 = { 558bec81ec08000000685a164a008b5d }
condition:
24 of them
}
rule BackdoorWin32Bafruz_611cb1f2b67293faebdedf0595fa7229ca1f23c25d8a1bcc0e4d2b1c579188da {
strings:
$a_2 = { 558bec81c4c4feffff535633c9898dc4 }
$a_3 = { 558bec83c4f8535633c08945fca118a9 }
$a_4 = { 558bec5356578bf98bf28bd8a0b02c45 }
$a_5 = { 558bec33c055684179420064ff306489 }
$a_6 = { 558becba4c414500a148804800e8defa }
$a_7 = { 558bd6a114ab4800e84e330000e84d30 }
$a_8 = { 558bec33c055689978420064ff306489 }
$a_9 = { 558bec83c4f48955f88945fca144a848 }
$a_10 = { 558becba50564500a148804800e8e2e5 }
$a_11 = { 558bec81c434ffffff5356578bf18955 }
$a_12 = { 558b45fce862e3feffe8f1feffff5988 }
$a_13 = { 558bec53565784d2740883c4f0e8a6c5 }
$a_14 = { 558bec6a0033d25568d9e3460064ff32 }
$a_15 = { 558bec51538d5dfca13c7c48008b5508 }
$a_16 = { 558bec33c055688759480064ff306489 }
$a_17 = { 558bec83c4f0538bd88bc38b10ff1252 }
$a_18 = { 558bec33c95151515133c05568dba741 }
$a_19 = { 558bc3e87eabffff84c07426a1d89648 }
$a_20 = { 558be833db668b7d0e668b750c662bf7 }
$a_21 = { 558becbac0444500a148804800e86ef7 }
$a_22 = { 558bec6a0033c05568fe89460064ff30 }
$a_23 = { 558bec33c055685928410064ff306489 }
$a_24 = { 558bec6a005333c055685b9f460064ff }
$a_25 = { 558bec5153568bf28bd88bceb201a108 }
$a_26 = { 558bec83c4f85356578945fca1407048 }
$a_27 = { 558becba1c3f4500a148804800e816fd }
$a_28 = { 558be8a114ab4800e8506a00008bf04e }
$a_29 = { 558becba88514500a148804800e8a6ea }
$a_30 = { 558becba505a4500a148804800e8dee1 }
condition:
24 of them
}
rule BackdoorWin32Bancodor_f29262f3a4a7bb2d3decc74703973ffe706334fa6a8b755d858ed42ffde0336e {
strings:
$a_2 = { 558bec33c055685d5e460064ff306489 }
$a_3 = { 558bec515356578945fc33c05568f6ad }
$a_4 = { 558bec33c0556875d9410064ff306489 }
$a_5 = { 558bc3e8aeabffff84c07426a148c746 }
$a_6 = { 558bec51538d5dfca178a946008b5508 }
$a_7 = { 558bec535684d2740883c4f0e8afc8fe }
$a_8 = { 558bec51535684d2740883c4f0e8d6ee }
$a_9 = { 558b55f88b45fc8b4df4e866faffff59 }
$a_10 = { 558bec53568bf28bd88b53708bc6e809 }
$a_11 = { 558bec33c055682ae9450064ff306489 }
$a_12 = { 558bec33c055681536460064ff306489 }
$a_13 = { 558bec33c0556834b9440064ff306489 }
$a_14 = { 558bec6a0053568bd833c055687b0043 }
$a_15 = { 558bec518945fc8b45fce8cdaafdff8b }
$a_16 = { 558b55f88b45fc8b4df4e835faffff59 }
$a_17 = { 558bec83c4f433c08945f433c05568a3 }
$a_18 = { 558b55f88b45fc8b4df4e8fafbffff59 }
$a_19 = { 558bd38b8698010000e89492fdffe8cb }
$a_20 = { 558bec6a006a00568bf033c0556817f3 }
$a_21 = { 558bec515356578bf98bf28945fc6860 }
$a_22 = { 558bd6a130dc4600e8a2320000e8d12f }
$a_23 = { 558bec33c05568f687420064ff306489 }
$a_24 = { 558bec6a005333c0556827ff450064ff }
$a_25 = { 558bec53568b5d088d430450e877b2ff }
$a_26 = { 558bec535657a1f4d94600e8787affff }
$a_27 = { 558bec535657833d2cdc460000743c33 }
$a_28 = { 558b43045081c700bc00005755e871b6 }
$a_29 = { 558bec5356578b5d0833c0556882d041 }
$a_30 = { 558bfa8bf033db8b06e81f5affff8bd0 }
condition:
24 of them
}
rule BackdoorWin32Bandok_7e395446d4b37c93adc2e24c6598db483874089db85a05cf971931137c0ec24a {
strings:
$a_2 = { 558bec6a0168e0631f13e83ffbffff83 }
$a_3 = { 558bec6880e01e13ff15a8301513a36c }
$a_4 = { 558bec6880e61e13e83ed6ffff83c404 }
$a_5 = { 558bec51683057151368fcdd1613e87b }
$a_6 = { 558bec81ec9401000053565768806d15 }
$a_7 = { 558bec83ec0c8b451c8945f88b4d148b }
$a_8 = { 558bec51685057151368fcdd1613e899 }
$a_9 = { 558bec81ec60060000c745fcffffffff }
$a_10 = { 558bec81ec440100008d85bcfeffff50 }
$a_11 = { 558becb828bf0200e8098900006860ea }
$a_12 = { 558bec516a646a00684ced1b13e8568e }
$a_13 = { 558bec81ec2c0100006a006a02e81343 }
$a_14 = { 558becb828bf0200e8d17f00006860ea }
$a_15 = { 558bec83ec306854fd1a13ff15a03015 }
$a_16 = { 558bec83ec086a006a0068407f1f136a }
$a_17 = { 558becc605ca7d1f1301682059151368 }
$a_18 = { 558bec81ec140100008b450c508d8df8 }
$a_19 = { 558bec81ecd000000068b46c151368c8 }
$a_20 = { 558bec81ec04020000c785fcfeffff00 }
$a_21 = { 558bec83ec086a008d45f8506a00683f }
$a_22 = { 558bec83ec188b451050e86c96000083 }
$a_23 = { 558bec33c0a0ce7d1f1385c075186a00 }
$a_24 = { 558bec68000100006a006800d91613e8 }
$a_25 = { 558bec6880e11e13e8f766ffff83c404 }
$a_26 = { 558bec83ec188b451083b88800000000 }
$a_27 = { 558bec68a8d31e13e8b0d7ffff83c404 }
$a_28 = { 558becc605cb7d1f1301686059151368 }
$a_29 = { 558bec68bc6e15136844011f13e8250e }
$a_30 = { 558bec33c0a0ce7d1f1383f801752668 }
condition:
24 of them
}
rule BackdoorWin32Banito_7e8050cf928fa8267b5e195db09fd43cd56d2135596ccb3b71cd18870bd1dd63 {
strings:
$a_2 = { 558bec33c055684192420064ff306489 }
$a_3 = { 558bec6a00538bd833c05568e0ef4800 }
$a_4 = { 558becff750cff7508ff15a09649005d }
$a_5 = { 558bec33c055686924400064ff306489 }
$a_6 = { 558bec51568bf06a208bcaa100274100 }
$a_7 = { 558bec535684d2740883c4f0e87758fa }
$a_8 = { 558bec33c055685401460064ff306489 }
$a_9 = { 558bec6a005356578bd833c05568239a }
$a_10 = { 558bf18bfa8bd8837e6400740aa1f88b }
$a_11 = { 558bec538b5d083b1d447c4900744aa1 }
$a_12 = { 558bec33c055682519470064ff306489 }
$a_13 = { 558bf0bf10964900bd149649008b1d08 }
$a_14 = { 558bec6a005356578bd833c055687f19 }
$a_15 = { 558bec33c05568f346480064ff306489 }
$a_16 = { 558be8a1089c4900e8ac6900008bf04e }
$a_17 = { 558bea8bf08bd6b860904000e868ffff }
$a_18 = { 558bec33c05568d518470064ff306489 }
$a_19 = { 558bec53568bf28bd88b53708bc6e811 }
$a_20 = { 558bec83c4f0b8fc5f4900e8c809f7ff }
$a_21 = { 558bec53bb7898490033c05568fa0841 }
$a_22 = { 558bec6a0033c055683e2e470064ff30 }
$a_23 = { 558bec33c95151515133c055689cbb41 }
$a_24 = { 558bec83c4d85356576a0ea148894900 }
$a_25 = { 558bec6a0053568bd833c05568143949 }
$a_26 = { 558bec6a00538bd833c055687f9d4800 }
$a_27 = { 558becff7508e89efeffff85c074188b }
$a_28 = { 558becb92e0000006a006a004975f951 }
$a_29 = { 558bec33c055685d6c400064ff306489 }
$a_30 = { 558bec81c404f0ffff5083c4d4535633 }
condition:
24 of them
}
rule BackdoorWin32Bdaejec_17a906fe3f13a602c4d0c3ec21f15086c18354af7e1ce1d657934cd5e2002e45 {
strings:
$a_2 = { 558b08e9b9a8019030ebdd7ba028de42 }
$a_3 = { 558b678b7c7ac6e077e7df36783c45de }
$a_4 = { 558b8001e67b1c79f03835c59462adb0 }
condition:
3 of them
}
rule BackdoorWin32Beastdoor_39b1878ad637d4606870e7025a64db56f32aa9c383f74c1172a7059f9fbd8fb7 {
strings:
$a_2 = { 558b4917cc1ab93c5b6c30a8d9a9d3b9 }
$a_3 = { 558b3221af017821c5040dd4b643f994 }
condition:
2 of them
}
rule BackdoorWin32Bedep_e7f8018121c96addda245a13547fb1614b11393684fb6ec1ee687966781bebb2 {
strings:
$a_2 = { 558bec83ec348b0d7c6c011081e945ac }
$a_3 = { 558bec83ec208b15786c011081eabd7a }
$a_4 = { 558b1c6929c94d4fea4b46491bd33072 }
$a_5 = { 558bec83ec408b157c6c011081eaf67d }
$a_6 = { 558bec83ec18a17c6c01102d08f88fe4 }
$a_7 = { 558bec83ec188b0d786c011081e9f024 }
$a_8 = { 558bd016487d006554274c506a732f06 }
$a_9 = { 558bec83ec708b0d786c011081e91c89 }
$a_10 = { 558bec81ec2c020000a17c6c01102d8d }
$a_11 = { 558bec83ec208b0d786c011081e9acb3 }
$a_12 = { 558bec83ec30c745f8c57f58520fb745 }
$a_13 = { 558bec83ec2ca1786c01102d624733dc }
$a_14 = { 558bec83ec248b15786c011081ead137 }
$a_15 = { 558bec83ec2cb8a8b34e5a8945fc8b0d }
$a_16 = { 558bec83ec288b0d7c6c011081e9e900 }
$a_17 = { 558bec83ec30b92f009f32894df866c7 }
$a_18 = { 558bec81ec5c0200008b0d786c011081 }
$a_19 = { 558bec83ec2c51b80a8f170b8945e866 }
$a_20 = { 558bec83ec208b0d7c6c011081e9b702 }
$a_21 = { 558bec83ec30b9845339fe894df88b55 }
$a_22 = { 558bec83ec2c8b0d7c6c011081e94776 }
$a_23 = { 558becff751c59ff75145cff75185dff }
$a_24 = { 558bec83ec30a1786c01102d0922647f }
$a_25 = { 558bec83ec188b0d7c6c011081e97140 }
$a_26 = { 558bec83ec1c8b0d786c011081e959f1 }
$a_27 = { 558bec83ec3ca1786c01102d38745221 }
$a_28 = { 558bec83ec208b157c6c011081ea62df }
$a_29 = { 558bec83ec1c8b0d7c6c011081e99707 }
$a_30 = { 558bec83ec74a17c6c01102d9f1b95ce }
condition:
24 of them
}
rule BackdoorWin32Begman_3cb14e505e07e5365f2e4a4ea5073f257a2b60934572a825bd66f9dbd3639d9b {
strings:
$a_2 = { 558becff7508e8a1fdffff5dc2040090 }
$a_3 = { 558bec33c055682f27141364ff306489 }
$a_4 = { 558bec33c055681b98141364ff306489 }
$a_5 = { 558bec33c05568cc54141364ff306489 }
$a_6 = { 558b191991c3fdec9c43302d7e2c66d7 }
$a_7 = { 558bec33c055682180141364ff306489 }
$a_8 = { 558bec83c4c4b824981413e86090ffff }
$a_9 = { 558bb7bbb3198d8feb2d8e6229d0cc14 }
$a_10 = { 558bec33c05568312a141364ff306489 }
$a_11 = { 558b6a0883c105e88effffffffd15d5f }
$a_12 = { 558bec33c05568d889141364ff306489 }
$a_13 = { 558bec33c055688929141364ff306489 }
$a_14 = { 558bec83c4e88d45e850e8f1fdffff0f }
$a_15 = { 558bec83c4f853568b75108b5d0c2b5d }
$a_16 = { 558bec53568bf28a108bd9c1eb0832d3 }
$a_17 = { 558bec52508b450850516a006a00e825 }
$a_18 = { 558bec33c055685129141364ff306489 }
$a_19 = { 558bec33c05568c397141364ff306489 }
condition:
15 of them
}
rule BackdoorWin32Beksnoc_be71a98f673d21f75756f23ea893131f4c740d69b8515dbd9a793b700059f305 {
strings:
$a_2 = { 558bec83ec4068001507f168001915b3 }
$a_3 = { 558bec83ec386a3f6a4068000d2ed168 }
$a_4 = { 558bec83ec3868008af48b68006e1f93 }
$a_5 = { 558bec83ec3833d2b81c0000008955e8 }
$a_6 = { 558bec83ec346a436abfe81e01000083 }
$a_7 = { 558bec83ec3c6800720c0ce829140000 }
$a_8 = { 558bec83ec40e8a90d000068001d0631 }
$a_9 = { 558bec83ec50b969000000894dd86aad }
$a_10 = { 558bec83ec3c6a3fe8e909000083c404 }
$a_11 = { 558bec83ec386ab56800114f7c6800a7 }
$a_12 = { 558b45e883f91e754d3175e82bd32955 }
$a_13 = { 558b3f6b478c786e11dd7b7377900385 }
$a_14 = { 558bec83ec3833c0b96f0000006ab0e8 }
$a_15 = { 558bec83ec18b8250000008b156c2041 }
condition:
12 of them
}
rule BackdoorWin32Berbew_0bf049ee62df1298fdbef1a6b2fa9fe0b75c3edf1076a9da839b0c93e16c0db8 {
strings:
$a_2 = { 558bec81ec04010000b86c0000008985 }
$a_3 = { 558b32e521f103dc8350d1d31f5b03ff }
$a_4 = { 558b66e723f103dc5d0bf2de9e0e201a }
$a_5 = { 558b4ae521f103dc57b342e521f189a7 }
$a_6 = { 558bec83ec50b8540000008945d0538b }
$a_7 = { 558b3ae522f103d9518b6ae522f1dabb }
$a_8 = { 558b06e522f103d9578b2ae522f1da91 }
$a_9 = { 558b22f723f103c2edd603d934db861a }
$a_10 = { 558bec81ec980000008b0d6860400089 }
$a_11 = { 558bec83ec3cb971000000894de4538b }
$a_12 = { 558b45d40fbe0885c975158b55dc8b45 }
$a_13 = { 558bfee723f175af7cf375e5340bb21a }
$a_14 = { 558b6ae723f1019f3cf375e555c9e018 }
$a_15 = { 558b2ef423f183daa81adaf24a1f8a1a }
$a_16 = { 558bec83ec30ba840000008955d85383 }
$a_17 = { 558bec83ec44b8aa00000083e8f18945 }
$a_18 = { 558b56ed23f1613c578b56ed23f10aa6 }
$a_19 = { 558bec83ec30c745fcbf000000837d08 }
$a_20 = { 558b4ae521f103dc344bc81adcb7801a }
$a_21 = { 558bec83ec68b8de0000008945ac5305 }
$a_22 = { 558b76e423f103dc5dc8c209dc0ee280 }
$a_23 = { 558bec83ec34ba2aab00008955d8538b }
$a_24 = { 558b4ae521f103dc34fbb71adcb7801a }
$a_25 = { 558b52e522f103d95dfde10bdc0ee2e5 }
$a_26 = { 558b7d9c03c03b0568604000744883fe }
$a_27 = { 558bec83ec588b450c8945ecc745e423 }
$a_28 = { 558bec83ec2cb8de0000008945f85383 }
$a_29 = { 558bec83ec2cc745fc8c0000008b45fc }
$a_30 = { 558bec83ec64b8e10000008945fc538b }
condition:
24 of them
}
rule BackdoorWin32Bergat_9e7e1a2a2b804c163c83ebaace5c680db7c3ad2c65c0cb446017eeabb01e0824 {
strings:
$a_2 = { 558bec83ec08687615400064a1000000 }
$a_3 = { 558bba1783cb74cb889356c69b9ceac9 }
$a_4 = { 558b84134fe2a17c74bc988d4d9bcd65 }
$a_5 = { 558b6ff9527bce0e2fc8468be44cbdab }
$a_6 = { 558bec83ec0c687615400064a1000000 }
condition:
5 of them
}
rule BackdoorWin32Bezigate_4db0ea8d376417e7be02792907d8c24f0676358adf68d77ce69b89cd85bec63b {
strings:
$a_2 = { 558bec33c05568dd40400064ff306489 }
$a_3 = { 558bec33c055681146400064ff306489 }
$a_4 = { 558bec33c055689d70400064ff306489 }
$a_5 = { 558bec33c055680967400064ff306489 }
$a_6 = { 558bec83c4f453c645ff0068dc2a4000 }
$a_7 = { 558bec33c055689516400064ff306489 }
$a_8 = { 558bec83c4e05356578b7d0c8b5d0833 }
$a_9 = { 558bec33c055685516400064ff306489 }
$a_10 = { 558bec33c055686515400064ff306489 }
$a_11 = { 558bec33c05568c95f400064ff306489 }
$a_12 = { 558bec518b45088b008b550c8d44d078 }
$a_13 = { 558bec33c05568fd2c400064ff306489 }
$a_14 = { 558bec33c055686542400064ff306489 }
$a_15 = { 558bec33c055683563400064ff306489 }
$a_16 = { 558b1d6c8040008b35c48040008b3de8 }
$a_17 = { 558bec83c4b053568bd833c08945fc68 }
$a_18 = { 558bec33c055681521400064ff306489 }
$a_19 = { 558bec83c4f8e839bfffff8945f8837d }
$a_20 = { 558bec83c4f45356578b5d108d7df48b }
$a_21 = { 558bec33c055681969400064ff306489 }
$a_22 = { 558bec33c055681966400064ff306489 }
$a_23 = { 558bec83c4f85356578d7dfc8b45088b }
$a_24 = { 558bec81c458faffff538b5d0885db75 }
$a_25 = { 558bec5356578bf98bf28bd8e883fcff }
$a_26 = { 558bec83c4f0b810714000e8dc9effff }
$a_27 = { 558bec33c055680771400064ff306489 }
$a_28 = { 558bec33c05568ed15400064ff306489 }
$a_29 = { 558bec33c05568bd62400064ff306489 }
$a_30 = { 558bec53568bf28bd833c08a45083d8d }
condition:
24 of them
}
rule BackdoorWin32Bezigate_facffb96005a78c6a570f04693ce7f2d9712fd7e433856eeee0c035641b46ccb {
strings:
$a_2 = { 558bec83ec0c680615400064a1000000 }
$a_3 = { 558bec83ec14680615400064a1000000 }
$a_4 = { 558bec83ec18680615400064a1000000 }
$a_5 = { 558bec6a1858e8e890f0ff668b450c66 }
condition:
4 of them
}
rule BackdoorWin32Bifrose_26d8703bad3949ca1417c81612705ca9decf9d6fd32b22acc0c4b187f7d69d25 {
strings:
$a_2 = { 558bec33c05568591c400064ff306489 }
$a_3 = { 558bec33c055683b24400064ff306489 }
$a_4 = { 558b6a0883c105e8aeffffffffd15d5f }
$a_5 = { 558bec33c05568b71a400064ff306489 }
$a_6 = { 558bec83c4f88945fc8b45fce8abf9ff }
$a_7 = { 558b6a4afb04d57b6ea72a2c78b33a4f }
$a_8 = { 558b8e97fa5eeb1688614632643fd34c }
$a_9 = { 558b552d3a6d871d6921baaf93457001 }
$a_10 = { 558bf98bea8bf0b8e81340003b051830 }
$a_11 = { 558bec33c05568211d400064ff306489 }
$a_12 = { 558bec33c05568911c400064ff306489 }
$a_13 = { 558bec33c05568611d400064ff306489 }
$a_14 = { 558bec83c4ec33c08945ecb844244000 }
$a_15 = { 558b9501dfd90654979cc06a338d09f8 }
$a_16 = { 558b3578d0711d32f8bd27b10ee8477d }
condition:
13 of them
}
rule BackdoorWin32Bifrose_704fec3efc202aaf8a649ca660f58b99ec793a7fa0a48bd79eda005551e44d1a {
strings:
$a_2 = { 558bd2e18419ffb6b37680c0097e6b0d }
$a_3 = { 558bec83c85456ec75fbe7ab10d3fab7 }
condition:
2 of them
}
rule BackdoorWin32Binanen_a324f787c893b8a52639d9ff5dd73de05f184804507f79dce4428db3143857ff {
strings:
$a_2 = { 558b94796fb4fb20e04400c01b878cfb }
$a_3 = { 558bd039608b24ae6444500584703fb7 }
condition:
2 of them
}
rule BackdoorWin32Bisar_c895678770d4839b702c0963cae3b5d8d010c9455be01b655fd54e69016306dc {
strings:
$a_2 = { 558bec83ec185333db395838750f6a02 }
$a_3 = { 558bec8b45080bc0740e6681384a4375 }
$a_4 = { 558becb88001000081ecb00200003945 }
$a_5 = { 558bec515657e881f6ffffe9ff7508ff }
$a_6 = { 558bec5151538b5d10568bf1578b7e04 }
$a_7 = { 558bec83ec0c837d08025673138b450c }
$a_8 = { 558b16035604ff45fc8b45088b4dfc83 }
$a_9 = { 558bec81ec38030000535657e81af6ff }
$a_10 = { 558bec83ec105356578b7d088b473c8d }
$a_11 = { 558bec83c4f4fc5357568b7424208b7c }
$a_12 = { 558bec518b4d148bc12b45108945fc74 }
$a_13 = { 558bec51e8a3ffffffe98b450885c074 }
$a_14 = { 558bec81ec90080000e8a7040000e983 }
$a_15 = { 558bec81ec18020000535657e8c5feff }
condition:
12 of them
}
rule BackdoorWin32Bits_78b775564657f01745f5861c395817726b3c3a1f63c00668bdbd7210b8e79a43 {
strings:
$a_2 = { 558bec6aff680881b140d00864a15064 }
$a_3 = { 558b72615860411c501850453b1b2d51 }
$a_4 = { 558bec83c4fc461c98bd5b81ebe7138b }
condition:
3 of them
}
rule BackdoorWin32Bittaru_5fe75b35ef4db4a057c59eebf62844bda4c334576f12d89ae6359eadff1c1fff {
strings:
$a_2 = { 558bec83c4f8ff7508e8c60400008945 }
$a_3 = { 558bec81c4ecddffff68002000008d85 }
$a_4 = { 558bec81c4ecfeffff681a51400068ba }
$a_5 = { 558bec81c4c8feffff683951400068c7 }
$a_6 = { 558bec83c4dc60687751400068ba5040 }
condition:
5 of them
}
rule BackdoorWin32BlackAngel_ee0b16b04e0ceee4a770e93a8734b9bd52062fe50ae3506762e94204e15ec02d {
strings:
$a_2 = { 558b3a54893a5286394e83384b80374b }
$a_3 = { 558b0c84279e5d51d6c3111b288d95ec }
$a_4 = { 558b512b43783aa99b70194238fc5981 }
$a_5 = { 558b8448c4a9e6b0e6349189452c0e68 }
$a_6 = { 558bec83ec0c684464a1f6ff3b4f2964 }
$a_7 = { 558b9d5936f430807d81d126f017b4b5 }
$a_8 = { 558bc0568ec2598ec35c8fc45e8cc260 }
$a_9 = { 558b653a53873c54883d558a3d568b3f }
$a_10 = { 558bce8493a688542a21e7211a616562 }
$a_11 = { 558bf4ea202c184c55f7b1d6d2562f77 }
$a_12 = { 558b4b5d60a2a388b886f0df12ada594 }
$a_13 = { 558b1c084b88758f129d81dd80154076 }
$a_14 = { 558b3fac010d6969795ec208698d7969 }
condition:
11 of them
}
rule BackdoorWin32Blackhole_92f36bcc35a1cf2bfbf8d5f918fc22f4e35709be2ed1f049cc7e8f8e595a80dd {
strings:
$a_2 = { 558bec83c4f8538bd8c645ff01683f00 }
$a_3 = { 558bec6a005333d255682dc8420064ff }
$a_4 = { 558bec83c4f8e829e3feff8855fb8945 }
$a_5 = { 558bec6a0033c05568674c440064ff30 }
$a_6 = { 558bec33c05568f165400064ff306489 }
$a_7 = { 558b45f4e8f2feffff595f5e5b8be55d }
$a_8 = { 558bec53568bda8bf033c05568ac7043 }
$a_9 = { 558beca1a0f3440050a1002f450050e8 }
$a_10 = { 558bec83c4e0535633d28955fc8bd88d }
$a_11 = { 558becff7508e89dfdffff5dc2040090 }
$a_12 = { 558bec33c055685d10410064ff306489 }
$a_13 = { 558bec33c05568452b410064ff306489 }
$a_14 = { 558bec33c055684875430064ff306489 }
$a_15 = { 558bec81c438ffffff5356578bf98955 }
$a_16 = { 558bec33c05568bdfe420064ff306489 }
$a_17 = { 558bec51568bf06a208bcaa15c654100 }
$a_18 = { 558bec51535657894dfc8bfa8bf0e895 }
$a_19 = { 558bec51535657894dfc8bf28bf88b47 }
$a_20 = { 558bec33c05568e5de420064ff306489 }
$a_21 = { 558bec33c0556849cb420064ff306489 }
$a_22 = { 558bec33c05568f97e400064ff306489 }
$a_23 = { 558bec81c4e8fbffff5356578955fc8b }
$a_24 = { 558bec515356578bd833c0a3c0054500 }
$a_25 = { 558bec5333db8b450c83e810743a2d00 }
$a_26 = { 558bec33c055688930420064ff306489 }
$a_27 = { 558bec8b55088b450c8b4d10e8bbe4fd }
$a_28 = { 558bec33c055681165430064ff306489 }
$a_29 = { 558bec535657a18c2a4500e84cd3ffff }
$a_30 = { 558bce2bcb418bd38bc7e8602effff5d }
condition:
24 of them
}
rule BackdoorWin32Blazgel_6808ab8983caf53ff9e0a9c98395f2a6ec4885e1c656992dbc612dbfc83c7c1e {
strings:
$a_2 = { 558b2d5040400033f6a1a85340006880 }
$a_3 = { 558bec83ec4456ff15784040008bf08a }
$a_4 = { 558bac24ec020000565785ed75228b94 }
condition:
3 of them
}
rule BackdoorWin32Blohi_8763f6e16954c27cffdb506e00385990ea5dd3baa6e7adde797228be20346d58 {
strings:
$a_2 = { 558b157c49e0ce38a25138ff008308a8 }
$a_3 = { 558bec83ec0868762c400064a1000000 }
$a_4 = { 558bec83ec1468762c400064a1000000 }
$a_5 = { 558b638b46b4b8ca6f5810a47b481032 }
$a_6 = { 558b6c2430396c241c75298b54241852 }
$a_7 = { 558bec83ec1868762c400064a1000000 }
$a_8 = { 558bf81e550b49f03b29538587dac5d3 }
$a_9 = { 558bec83ec0c68762c400064a1000000 }
$a_10 = { 558b45ac66833801754c8b4dd46bc910 }
$a_11 = { 558b157c4a1e9e93d96d7887044a5438 }
$a_12 = { 558b157c5be99701f4b9af3a12ea2f6b }
$a_13 = { 558b2300c92253d52b2221c58e2a4a9d }
$a_14 = { 558b157c45508537d895e030e2254f04 }
condition:
11 of them
}
rule BackdoorWin32Blohi_b86ef1da08b710976c0484efb60aef477e7c2075471b682777dbcf3718ebb923 {
strings:
$a_2 = { 558b638b46b4b8ca6f5810a47b481032 }
$a_3 = { 558bf81e550b49f03b29538587dac5d3 }
$a_4 = { 558b30feffff1c8a2f3b2afbaa2dfbbc }
$a_5 = { 558b157c4a3293d96d7887044a54383a }
$a_6 = { 558b2300c92253d52b2221c58e2a4a9d }
$a_7 = { 558b57f004d11ab35b689a889a75073a }
$a_8 = { 558bec83ec0c68de008f411464a1e950 }
condition:
6 of them
}
rule BackdoorWin32BlueFire_4dc88bd5cda55023de0a75a91be0104d5697314968c2d2e5ce59325c7d16dc50 {
strings:
$a_2 = { 558bec81c450ffffff33c9898d50ffff }
$a_3 = { 558bec83c4f88955f88945fcb2018b45 }
$a_4 = { 558bec33c055683d1a420064ff306489 }
$a_5 = { 558bec83c4f48945fcb8010000008b55 }
$a_6 = { 558bec33c0556887b9470064ff306489 }
$a_7 = { 558bec81c4f4fbffff535657668955fa }
$a_8 = { 558bec83c4f88945fc8b45fc8b403080 }
$a_9 = { 558bc7e837ddffff50e875cefeff83c4 }
$a_10 = { 558bec83c4d05333d28955d08955fc89 }
$a_11 = { 558bec5356578b5d0833c055681d4741 }
$a_12 = { 558bec518945fc8b45fc8b00e8afc5fa }
$a_13 = { 558bec6a00535633c05568ada5400064 }
$a_14 = { 558bec83c4f484d2740883c4f0e8f2c6 }
$a_15 = { 558bf18bfa8bd8837e5800740aa1e8d7 }
$a_16 = { 558bec51538bda8945fc8bc38b1514dd }
$a_17 = { 558bec83c4f45657894df48955f88945 }
$a_18 = { 558bec83c4f88955f88945fc8b45fc66 }
$a_19 = { 558bec51538bd86a008bcaa1d0e24000 }
$a_20 = { 558b065053576a006a00e876caffff81 }
$a_21 = { 558bec6a005633c0556857a6400064ff }
$a_22 = { 558bec33c055682b45470064ff306489 }
$a_23 = { 558bec83c4e0538945fc8b45fc83b850 }
$a_24 = { 558bec83c4f453668955fa8945fc8b45 }
$a_25 = { 558bce2bcb418bd38bc7e8f0bdffff5d }
$a_26 = { 558bec83c4f88945fc833d90e8470000 }
$a_27 = { 558bec83c4e45356578bf0a120e64700 }
$a_28 = { 558bec83c4f4538bd852e8c1a8ffff89 }
$a_29 = { 558b342485f6742f8bc666bbdbffe878 }
$a_30 = { 558bec33c0556871e3410064ff306489 }
condition:
24 of them
}
rule BackdoorWin32Boomie_b57dc72f89d3066b4d042f043ebd110248aa3b2041c1a1636be5304088850431 {
strings:
$a_2 = { 558bec51515333db391dc89d40005657 }
$a_3 = { 558bec6aff68c0614000684c27400064 }
$a_4 = { 558bec6aff68b0614000684c27400064 }
$a_5 = { 558bec51833d3c9a40000053751d8b45 }
$a_6 = { 558becb82c120000e8c91000008d8568 }
$a_7 = { 558bec51568b750885f6745aa1ac9c40 }
$a_8 = { 558bec6aff6880614000684c27400064 }
$a_9 = { 558bec6aff6808654000684c27400064 }
$a_10 = { 558bec6aff6850654000684c27400064 }
$a_11 = { 558bec6aff68d0614000684c27400064 }
$a_12 = { 558bec6aff6870614000684c27400064 }
$a_13 = { 558bec6aff6860614000684c27400064 }
$a_14 = { 558bec6aff68a0614000684c27400064 }
$a_15 = { 558bec535657556a006a00686c264000 }
$a_16 = { 558bec515153568b3540974000578b56 }
$a_17 = { 558b2dd8604000565733db33f633ff3b }
$a_18 = { 558bec6aff6890614000684c27400064 }
$a_19 = { 558bec5153568b352477400057837e10 }
$a_20 = { 558bec6aff6850614000684c27400064 }
$a_21 = { 558bec6aff6840614000684c27400064 }
$a_22 = { 558bec83ec14a1709a40008b15749a40 }
condition:
18 of them
}
rule BackdoorWin32Botgor_2a315bf70748c1c4fb2c0bc9253ec3e0262ce2ea83c85998849abc9fc2f695c4 {
strings:
$a_2 = { 558bec83ec3c8b4508837804007509c7 }
$a_3 = { 558bec83ec60894da08b45a08b480489 }
$a_4 = { 558bec83ec145657894dec8b45ec8b48 }
$a_5 = { 558bec81ec340800005657e840ffffff }
$a_6 = { 558bec83ec245657894de08b45088a08 }
$a_7 = { 558bec83ec34894dcc8b45cc83c06489 }
$a_8 = { 558bec83ec18894de88b45e88945f08b }
$a_9 = { 558bec83ec0c894df8eb128b450c83e8 }
$a_10 = { 558bec83ec44894dbc8b45bc8b480c89 }
$a_11 = { 558bec51894dfceb128b450c83e80189 }
$a_12 = { 558bec81ec0404000053565733c085c0 }
$a_13 = { 558bec83ec1c894de48b45088a088b55 }
$a_14 = { 558bec51894dfc8b4dfce801b1ffff8b }
$a_15 = { 558bec83ec0c894dfc8b450c83780400 }
$a_16 = { 558bec8b4508c1e81d8b0485bc154000 }
$a_17 = { 558bec83ec14894dec8b45ec8b088379 }
$a_18 = { 558bec83ec1c894de48b45088945fceb }
$a_19 = { 558bec6aff687207410064a100000000 }
$a_20 = { 558bec83ec705657eb098b450883c010 }
$a_21 = { 558bec83ec0c894df8eb128b451083c0 }
$a_22 = { 558bec6aff689e06410064a100000000 }
$a_23 = { 558bec83ec0c5657894df8eb128b450c }
$a_24 = { 558bec83ec48894dc88b45c88b480489 }
$a_25 = { 558bec83ec7c894d988b45988b48048b }
$a_26 = { 558bec83ec50894db08b45088a088b55 }
$a_27 = { 558bec8b4508c1e81025ffff000025ff }
$a_28 = { 558bec6aff689107410064a100000000 }
$a_29 = { 558bec51894dfceb098b450883c00489 }
$a_30 = { 558bec81ec7803000053565768901540 }
condition:
24 of them
}
rule BackdoorWin32Brabot_f78164feac66648e217952c2b2e99bc6e1d21b7b292a680065b16d20c2e24a33 {
strings:
$a_2 = { 558bec81ec900100005657e808f9ffff }
$a_3 = { 558bec81ec88010000837d0c00535657 }
$a_4 = { 558bec53ff750ae8727800008b4d208b }
$a_5 = { 558bec81ec80000000535733ff33db39 }
$a_6 = { 558bec515156be182018225756ff15c8 }
$a_7 = { 558bec83ec0c53568b750c8bd985f67d }
$a_8 = { 558bec538b1da8101722568b7510ff75 }
$a_9 = { 558bec515156578d79508bcfe80fc5ff }
$a_10 = { 558b6c240c568bf1578bfd8d5e048bcb }
$a_11 = { 558bec515153568b750c33db57538b06 }
$a_12 = { 558bec81ec8c01000053568b75085733 }
$a_13 = { 558bec83ec08684615400064a1000000 }
$a_14 = { 558bec8b450856578b484885c9752c83 }
$a_15 = { 558bec81ec1c020000c745fc00000000 }
$a_16 = { 558bec83ec28c745e00000000066c745 }
$a_17 = { 558bec81ec4c0200005766c785f8fdff }
$a_18 = { 558bec83ec18668b4510668945f4c745 }
$a_19 = { 558beca19ca0400083c04050ff1590a0 }
$a_20 = { 558bec8b450c2d100100007420487517 }
$a_21 = { 558b6c240c568b74240c578bd18b063d }
$a_22 = { 558bec518b4508563b414c5775508d71 }
$a_23 = { 558bec83ec18535657ff7508ff15c012 }
$a_24 = { 558bec83ec20535657be6c6917228d7d }
$a_25 = { 558bec8b450c2d130100000f84784600 }
$a_26 = { 558b860801000085c0755aff35302018 }
$a_27 = { 558bec538b5d0c56be18201822832300 }
$a_28 = { 558bec51a19ca0400083c02039450875 }
$a_29 = { 558bec81ecdc07000057a19ca0400083 }
$a_30 = { 558bec81ec04010000ff750c8d85fcfe }
condition:
24 of them
}
rule BackdoorWin32Buhtrap_ceefcc4db696c0dfc87c983388e2be66ed782e9c9eb259651cb174a40985cfdf {
strings:
$a_2 = { 558bec33c05568715d410064ff306489 }
$a_3 = { 558bec53803dc4954100000f84cc0000 }
$a_4 = { 558bec515356578bf28bd8803dc49541 }
$a_5 = { 558bec33c055683961410064ff306489 }
$a_6 = { 558bec33c05568c15e410064ff306489 }
$a_7 = { 558bec6a00535633c05568259b400064 }
$a_8 = { 558bec81c468feffff535657c7054097 }
$a_9 = { 558bec53565768987a410068a07a4100 }
$a_10 = { 558bec535684d2740883c4f0e87be5fe }
$a_11 = { 558bec536810694100e85ef1feff8bd8 }
$a_12 = { 558bec83c4f853568bf18bdae8ebffff }
$a_13 = { 558bec5356e8a6effeff8bda8bf033c0 }
$a_14 = { 558bec33c05568c960410064ff306489 }
$a_15 = { 558bec538bd88bc3e88f3affff506a00 }
$a_16 = { 558bec33c05568415f410064ff306489 }
$a_17 = { 558bec53568bf06a008bc68b18ff5364 }
$a_18 = { 558bec51538bda8945fc8b45fce8c6c6 }
$a_19 = { 558bec33c05568b961410064ff306489 }
$a_20 = { 558bec81c400ffffff53568bda8bf085 }
$a_21 = { 558bec5153568bf28bd88d55ffb90100 }
$a_22 = { 558bec6a00538bd833c0556826d94000 }
$a_23 = { 558bec33c05568015d410064ff306489 }
$a_24 = { 558bec33c05568c964410064ff306489 }
$a_25 = { 558bec83c4f8e82914ffff8855fb8945 }
$a_26 = { 558becb201e816ffffff5dc3558bec33 }
$a_27 = { 558bec33c05568c95c410064ff306489 }
$a_28 = { 558bec535684d2740883c4f0e8affffe }
$a_29 = { 558bec33c05568395d410064ff306489 }
$a_30 = { 558bec53565784d2740883c4f0e8d603 }
condition:
24 of them
}
rule BackdoorWin32Bulord_3f06cabf3acfb8fb358a0cbdfc2aeca27712da6eb24f9b24bf751aaebd1d5115 {
strings:
$a_2 = { 558bec535657bfd8184400833f00756c }
$a_3 = { 558bec81c498feffff8945fc8b45fce8 }
$a_4 = { 558bec33c05568d580410064ff306489 }
$a_5 = { 558bf28bd833ff8bc3e8a784ffff508b }
$a_6 = { 558b45a0e8dfa9fcff508d45a0e82eac }
$a_7 = { 558bec33c055680195430064ff306489 }
$a_8 = { 558bec535657bf301644008b470885c0 }
$a_9 = { 558bec33d25568961a400064ff326489 }
$a_10 = { 558bec5356578bf033c0556836ac4300 }
$a_11 = { 558bec538bd8a158184400e888ffffff }
$a_12 = { 558bec33c05568790a410064ff306489 }
$a_13 = { 558bec33c055684069410064ff306489 }
$a_14 = { 558bec33c05568e544430064ff306489 }
$a_15 = { 558bec33c05568f85c410064ff306489 }
$a_16 = { 558bec33c05568d60b410064ff306489 }
$a_17 = { 558bec81c4a8faffff5356578955f889 }
$a_18 = { 558bec53803dbc154400000f84cc0000 }
$a_19 = { 558bec33c055680188410064ff306489 }
$a_20 = { 558bce2bcb418bd38bc7e800cbffff5d }
$a_21 = { 558bec538bd8833d3c17440012753a83 }
$a_22 = { 558bec81c4dcfeffff5356578945fc8b }
$a_23 = { 558bec538b5d085368b1d7000068302e }
$a_24 = { 558bec83c4f48d55f4e876d0ffff8945 }
$a_25 = { 558bec33c055682973430064ff306489 }
$a_26 = { 558bece8d8f2ffff5531c96830424000 }
$a_27 = { 558bec6a0053568bf18bda33c0556880 }
$a_28 = { 558bec51568bf06a208bcaa1d4154100 }
$a_29 = { 558bec33c05568c581430064ff306489 }
$a_30 = { 558bec33c05568d966430064ff306489 }
condition:
24 of them
}
rule BackdoorWin32Buskill_6133ede4f1f0d0050d1ef1b7a5d6b533b4638902b182ee565df81f9e4bbf737a {
strings:
$a_2 = { 558beca010c04200a2c0c541005dc3cc }
$a_3 = { 558bece811120000c705043041000000 }
$a_4 = { 558bec535657556a006a0068d8f34000 }
$a_5 = { 558bec51518d45f850ff15fcc142008b }
$a_6 = { 558bec83ec185356ff750c8d4de8e847 }
$a_7 = { 558bec83ec10ff75088d4df0e8e545ff }
$a_8 = { 558bec83ec10ff750c8d4df0e8798aff }
$a_9 = { 558bec51568d45fc33f6508975fce8e2 }
$a_10 = { 558bec83ec30a16034410033c58945fc }
$a_11 = { 558bec83ec088b45088945f88be55dc3 }
$a_12 = { 558bec83ec10ff75088d4df0e8cd55ff }
$a_13 = { 558bec8b450850e8830e000083c4045d }
$a_14 = { 558bec8b4508ff34c560374100ff1524 }
$a_15 = { 558bec5151a16034410033c58945fca1 }
$a_16 = { 558bec8b450c508b4d0851e8500a0000 }
$a_17 = { 558bec5151535633f6578b3ddcc84100 }
$a_18 = { 558becff3588c64100e81418000085c0 }
$a_19 = { 558bec51568b750c56e8d4a8ffff8945 }
$a_20 = { 558bec83ec0c5333db391d2cd2410056 }
$a_21 = { 558bec33c039053ccd410050ff7510ff }
$a_22 = { 558bec83ec1056ff750c8d4df0e85ee8 }
$a_23 = { 558bec83ec0ca16034410033c58945fc }
$a_24 = { 558bec83e4f081ec84000000a1603441 }
$a_25 = { 558bec83ec10ff75088d4df0e8ea43ff }
$a_26 = { 558bec5356576a006a00681baa400051 }
$a_27 = { 558bec83ec145657ff75088d4dece834 }
$a_28 = { 558bec81ec28030000a378ce4100890d }
$a_29 = { 558bec83ec14a16034410033c58945fc }
$a_30 = { 558bec83ec1056ff750c8d4df0e8ede7 }
condition:
24 of them
}
rule BackdoorWin32Bustem_d08f463577ff5e3e2a64ad66589d688709ed74c2a5b6632c433349da750b6427 {
strings:
$a_2 = { 558bec83ec10ff75088d4df0e8eae8ff }
$a_3 = { 558bec56ff75088bf1e83c84ffffc706 }
$a_4 = { 558bec6afe685872410068e0bb400064 }
$a_5 = { 558bec8b450c568b75088906e86a3800 }
$a_6 = { 558bec83ec2c894de4e9000000008b45 }
$a_7 = { 558bec81ec1c010000898de4feffffe9 }
$a_8 = { 558bec83e4f86aff68281d410064a100 }
$a_9 = { 558becff7508ff15682041005dc38bff }
$a_10 = { 558bec8b45088b0d5c8e410056395004 }
$a_11 = { 558bec83ec0ce9000000008b45088945 }
$a_12 = { 558bec8b45085633f63bc6751de8f7c7 }
$a_13 = { 558bec8b4508a3a89c4100a3ac9c4100 }
$a_14 = { 558bec83ec5057894db0e9000000008b }
$a_15 = { 558bec83e4f86aff68861c410064a100 }
$a_16 = { 558bec51894dfce9000000008b45fc50 }
$a_17 = { 558bec53568b3560204100578b7d0857 }
$a_18 = { 558b8d14f5ffff83c101898d14f5ffff }
$a_19 = { 558bec83ec08894df8e9000000008b45 }
$a_20 = { 558b3783c70489bddcfdffffe81adbff }
$a_21 = { 558bec833d5c9341000075108b45088d }
$a_22 = { 558bec565733f6ff7508e8abe2ffff8b }
$a_23 = { 558bec83ec08e9000000008b450c8d4c }
$a_24 = { 558bec8b4508a3d49c41005dc38bff55 }
$a_25 = { 558bec6a0a6a00ff7508e83d02000083 }
$a_26 = { 558bec8b4508a32c9b41005dc38bff55 }
$a_27 = { 558bec83ec38894df8e900000000837d }
$a_28 = { 558bec535657556a006a0068fc164100 }
$a_29 = { 558becb8e41a0000e8ba3b0000a1e880 }
$a_30 = { 558bec56e81f3800008b75083bb09800 }
condition:
24 of them
}
rule BackdoorWin32Buterat_be34b4069be3b4a92da44e9614a25b094dae4818fd76eb3e7931d952dc5342f0 {
strings:
$a_2 = { 558bec6aff68f9e24b0064a100000000 }
$a_3 = { 558bec6aff68b7be4b0064a100000000 }
$a_4 = { 558bec6aff68d8db4b0064a100000000 }
$a_5 = { 558bec8b450885c07e1b69c0e8030000 }
$a_6 = { 558bec51568b75086a00686c204d0056 }
$a_7 = { 558bec6aff6830724c0064a100000000 }
$a_8 = { 558bec6aff683da14b0064a100000000 }
$a_9 = { 558bec81ec84000000a190794f0033c5 }
$a_10 = { 558bec6aff68335f4c0064a100000000 }
$a_11 = { 558bec6aff68e0cb4b0064a100000000 }
$a_12 = { 558bec5de9abf8ffff558bec5de95bfa }
$a_13 = { 558becff7508ff35d47b4f00ff15d491 }
$a_14 = { 558bec6aff68e3a94b0064a100000000 }
$a_15 = { 558bec8b45088b400c85c074188b5514 }
$a_16 = { 558bec6aff6810344c0064a100000000 }
$a_17 = { 558bec5151a134a94f008a0084c0750c }
$a_18 = { 558bec568bf18b460850c7063c6f4d00 }
$a_19 = { 558bec538b5d083b5d0c747856578b7d }
$a_20 = { 558bec6aff68f8124c0064a100000000 }
$a_21 = { 558bec568b7508578bf98d4f5085f675 }
$a_22 = { 558bec6aff68fd004c0064a100000000 }
$a_23 = { 558bec0fb6450883c1085150e8886703 }
$a_24 = { 558bec5153568b7508578d450c508d55 }
$a_25 = { 558bec6aff687e364c0064a100000000 }
$a_26 = { 558bec51a190794f0033c58945fc8b55 }
$a_27 = { 558bec6aff6819bd4b0064a100000000 }
$a_28 = { 558bec56ff75088bf1e8e89bffffc706 }
$a_29 = { 558becff7508ff1598904c005dc38bff }
$a_30 = { 558bec6aff6878d84b0064a100000000 }
condition:
24 of them
}
rule BackdoorWin32Buzus_7fdf36f46adac244370be36b737c38e31d2e29f9f873ca586fc5624b6c0c6791 {
strings:
$a_2 = { 558b61de14a1672d0472e07451ffdad0 }
$a_3 = { 558b83a21d925a2500dccb9d12dad1c9 }
$a_4 = { 558bea4db492ce5acad5f40d2bad0972 }
$a_5 = { 558bc22066b284640052b26680ea17f6 }
$a_6 = { 558b3438ae19391f24883559c44865c1 }
$a_7 = { 558bea15f79ab3a0344960080571f62d }
$a_8 = { 558b78325ac8eaed004ba2e2bf93a03d }
$a_9 = { 5589e5f5c544232406bbece3128b0cef }
$a_10 = { 558b4a2feaa074ec18b8b700617fd7f5 }
$a_11 = { 558b56e6ad6a93008a816a6b78be0845 }
$a_12 = { 558b805e582c51c017cf90e003e6a909 }
$a_13 = { 558bfa5ef3eff6436a40e8d228a12bc1 }
$a_14 = { 558b82a2ddc3652b4993712c8526fd7a }
$a_15 = { 558bcc9fe9321efd0a25ee3299495114 }
$a_16 = { 558b3b866805942225145027963aff90 }
$a_17 = { 558bb6d53c9d2de97080e108c258f639 }
$a_18 = { 558bec83c456d8ee025a81ea9135008b }
$a_19 = { 558be9669af8cd0acb8e25fc674ec1ed }
condition:
15 of them
}
rule BackdoorWin32Cakl_7aa7e40339d37d5553a3f3ad78190d00a503576d2b8b6d23bf22899db751b28a {
strings:
$a_2 = { 558bec6a006a005356578b5d2c8b750c }
$a_3 = { 558bec51538bda8945fc8b45fce86adb }
$a_4 = { 558bec83c4f48b45088b108955f48b50 }
$a_5 = { 558bec83c4ac538d45bc33c9ba440000 }
$a_6 = { 558bec6a0033c055687050400064ff30 }
$a_7 = { 558bec33c055683f26400064ff306489 }
$a_8 = { 558bec6a006a005356578b5d308b751c }
$a_9 = { 558bec83c4b4b8fc504000e85cd3ffff }
$a_10 = { 558bec538b5d0868f44d400053e866d9 }
$a_11 = { 558bec33c05568f350400064ff306489 }
$a_12 = { 558bec538b4d088b890cffffff8b5d08 }
$a_13 = { 558bce2bcb418bd38bc7e8fceaffff5d }
$a_14 = { 558bec56578b4508c640ff008b4508c6 }
$a_15 = { 558bea8bf88bc7e831e9ffff8bf0bb01 }
$a_16 = { 558bf98bea8bf0b8041940003b050c60 }
$a_17 = { 558bec5153568b750883c6c4ff068b06 }
$a_18 = { 558bec6a006a0053568b5d0833c05568 }
$a_19 = { 558bec6a006a0053568b5d0c33c05568 }
$a_20 = { 558bec6a006a005356578b5d308b7510 }
$a_21 = { 558bec83c4f053568955fc8bf08b45fc }
$a_22 = { 558b9500ffffff8b85fcfeffffe896fe }
$a_23 = { 558bec81c4fcfeffff5356898d08ffff }
$a_24 = { 558bec538b4d0883b90cffffff007505 }
$a_25 = { 558b065053576a006a00e81aeeffff81 }
$a_26 = { 558bec5356578bd88b45088b40d88b55 }
$a_27 = { 558bec83c4c45356894dd48955cc8bf0 }
$a_28 = { 558bec6a006a005356578b5d0c8b7508 }
$a_29 = { 558bec6a006a005356578b5d1833c055 }
$a_30 = { 558bec33c055689d2c400064ff306489 }
condition:
24 of them
}
rule BackdoorWin32Caphaw_f6abc629553ca3262f366d49b0fa3bfb70353bd23b065cfb797a17ea0709d1ff {
strings:
$a_2 = { 558bec83ec10a150c2420053bb90c442 }
$a_3 = { 558bec5633f646393514cc4200577510 }
$a_4 = { 558bec83ec44c745f800000000c745c8 }
$a_5 = { 558bec5151833dc8cd420000538b5d08 }
$a_6 = { 558bec83ec30a150c242008945fc8b45 }
$a_7 = { 558bec83ec2033c08be55dc21000cccc }
$a_8 = { 558bec8b450803450c8a005dc3cccccc }
$a_9 = { 558bec83ec28a150c24200538b5d0c89 }
$a_10 = { 558bec83ec10a150c2420085c074073d }
$a_11 = { 558bec83ec14a150c24200538b5d1033 }
$a_12 = { 558bec83e4f081ec84000000a150c242 }
$a_13 = { 558bec53568b750857ff7604ff36e8bd }
$a_14 = { 558bec83ec38c745e000000000c745ec }
$a_15 = { 558bec83ec1c53c745f800000000c645 }
$a_16 = { 558bec5151dd0540b14000dd4508dae9 }
$a_17 = { 558bec83ec105333db391d58cd420056 }
$a_18 = { 558bec803dbccb42000053565774278b }
$a_19 = { 558bec83ec10a150c242008945fc5657 }
$a_20 = { 558bec83ec18dd05c0b14000dd5df8dd }
$a_21 = { 558bec81ec18050000a150c242008945 }
$a_22 = { 558bec83ec0ca150c242006a068945fc }
$a_23 = { 558bec518b45088a4d0c880832c08be5 }
$a_24 = { 558bec83ec1ca150c2420053568b7508 }
$a_25 = { 558b78db1c8b71e4fa16ea4d11e52e86 }
$a_26 = { 558bec83ec148b4d08a124d042008b15 }
$a_27 = { 558bec83ec4c5356576a0458e8dec0ff }
$a_28 = { 558bec83ec448b45d88be55dc21000cc }
$a_29 = { 558bec8b5508a1e0c1420053b960c142 }
$a_30 = { 558bec83ec5ca150c242008945fc538d }
condition:
24 of them
}
rule BackdoorWin32Carrotime_fcb7caf3c07dd2d297f8b6a2f7b685b71baf96a2b4a39bf307afaf9f3fdd0f3a {
strings:
$a_2 = { 558bec833d8c534200017505e8be1a00 }
$a_3 = { 558bec83ec1856a108534200e9cc0000 }
$a_4 = { 558bec51833db8514200fe7505e89d06 }
$a_5 = { 558bece8e8ffffffb8010000005dc3cc }
$a_6 = { 558bec81ec880100005356578955c889 }
$a_7 = { 558bec568b750885f67515e89fd5ffff }
$a_8 = { 558bec83ec10a1204042008365f80083 }
$a_9 = { 558bec83ec10ff75088d4df0e8fcb6ff }
$a_10 = { 558beca1084042008b0d0c4042005dc3 }
$a_11 = { 558bec81ec28030000a3a0544200890d }
$a_12 = { 558bec83ec10ff75088d4df0e8119fff }
$a_13 = { 558bec83ec0c5333db5657391d0c6142 }
$a_14 = { 558bec565733f6ff750cff7508e8b02a }
$a_15 = { 558bec5153568b353810420057ff3508 }
$a_16 = { 558bec81ec7401000056894df4dd0520 }
$a_17 = { 558bec81ec9000000056b91e000000e8 }
$a_18 = { 558bec83ec088955f8894dfc8b45f88b }
$a_19 = { 558bec83ec10a12040420033c58945fc }
$a_20 = { 558bec81ecc8010000a12040420033c5 }
$a_21 = { 558bec83ec2456894df4837df4007507 }
$a_22 = { 558bec8b4508b9304042003bc1721f3d }
$a_23 = { 558bece868090000b8010000005dc3cc }
$a_24 = { 558bec83ec20568855f8884dfc0fb645 }
$a_25 = { 558bec837d08007515e8a873ffffc700 }
$a_26 = { 558bec83ec2056894df8c745fc000000 }
$a_27 = { 558bec8b4508a3945342005dc38bff55 }
$a_28 = { 558bec568b75085756e85d0300005983 }
$a_29 = { 558bec83ec30b970364100e860260100 }
$a_30 = { 558bec8b4508a3c05f42005dc38bff55 }
condition:
24 of them
}
rule BackdoorWin32Ceckno_d4761220e6cbbb1358a790799b5197a5d1afc7c07ce655319b4e441c9aafed60 {
strings:
$a_2 = { 558bec6a00538bd833c055684b684000 }
$a_3 = { 558bec83c4f48b45088b108955f48b50 }
$a_4 = { 558bf0bf00a64000bd04a640008b1df8 }
$a_5 = { 558bec83c4f85356578945fca12c9040 }
$a_6 = { 558bec83c4f853568945fc8b45fc8b55 }
$a_7 = { 558bec83c4f05356578bda85db78078b }
$a_8 = { 558bec33c055686946400064ff306489 }
$a_9 = { 558bf28bd8eb0853e874eaffff8bd88a }
$a_10 = { 558bec33c055680944400064ff306489 }
$a_11 = { 558bec83c4f88945fc8b45fce857edff }
$a_12 = { 558bec33c05568c641400064ff306489 }
$a_13 = { 558bec33c05568d143400064ff306489 }
$a_14 = { 558bec33c05568a14a400064ff306489 }
$a_15 = { 558bec515356578945fc8b45fce842bf }
$a_16 = { 558bec33c05568c94b400064ff306489 }
$a_17 = { 558bec83c4f40fb705189040008945f8 }
$a_18 = { 558bec83c4ec56578b45088bf08d7dec }
$a_19 = { 558bec6a006a0053565733c055689078 }
$a_20 = { 558bec515356578bf28bd8803daca540 }
$a_21 = { 558becff7508e8e9feffff5dc2040090 }
$a_22 = { 558bec83c4f833c08945f833c0556808 }
$a_23 = { 558bec33c05568d94a400064ff306489 }
$a_24 = { 558bec33c05568d14c400064ff306489 }
$a_25 = { 558bec8b450883f8050f8739010000ff }
$a_26 = { 558bec83c4c8535657894dd88bda8945 }
$a_27 = { 558bec6a006a0053565733c055689a79 }
$a_28 = { 558bec83c4f45333d28955f48945fc8b }
$a_29 = { 558bec33c9515151515356be10a74000 }
$a_30 = { 558bec83c4f0b8088d4000e8a8b5ffff }
condition:
24 of them
}
rule BackdoorWin32Cinasquel_9eb906fb32788f5fb9c77c1c610d35b948a63c4c38c6fa5829fac7de49fb4c33 {
strings:
$a_2 = { 558b1bb0eedefd3783e804743e48740e }
condition:
2 of them
}
rule BackdoorWin32Cmjspy_4be85d41f680380d6378adc52bdda7906e6f07752cfe4f72b9a7c85eebbbc1bd {
strings:
$a_2 = { 558bec83c4d4e8ca7813008855d78945 }
$a_3 = { 558bec83c4f08855fb8945fc8b45fce8 }
$a_4 = { 558bec83c4dcb8e8de5500e8448f0e00 }
$a_5 = { 558bec83c4f88855fb8945fc8b45fc83 }
$a_6 = { 558bec83c49433c05356578b5d08c645 }
$a_7 = { 558bec8a450c5dc3558bec518b45088a }
$a_8 = { 558bec83c4dcb8f8e05500e8d8880e00 }
$a_9 = { 558bec83c4d85356576a0ea170245700 }
$a_10 = { 558bec53565784d2740883c4f0e82ab3 }
$a_11 = { 558bec83c4ccb894e45600e8ac8bfeff }
$a_12 = { 558bec83c4985389559c8945a0b8e08b }
$a_13 = { 558bec81c46cffffffb8fcdc5500e84d }
$a_14 = { 558bec83c4c88955cc8945d0b8d0bc55 }
$a_15 = { 558bece8a43d0e0033d28910ff750cff }
$a_16 = { 558bec83c4c0b86c765500e8788f0f00 }
$a_17 = { 558bec83c4f88b4508ff7010e837b90d }
$a_18 = { 558bec33c055687158470064ff306489 }
$a_19 = { 558bec83c4f8e8e52805008855fb8945 }
$a_20 = { 558bec5153568bf28945fc837dfc0074 }
$a_21 = { 558bec83c4c4894df48955f88945fc8b }
$a_22 = { 558bec83c4ec8955f88845ffc745f4ff }
$a_23 = { 558bec83c4f0884dfa8855fb8945fc8b }
$a_24 = { 558bec81c454ffffffb8a0f556005356 }
$a_25 = { 558bec83c4f48945fc8b45fc8b1538a3 }
$a_26 = { 558bec83c4c45356578955c48945c8b8 }
$a_27 = { 558bec83c4f88945fc8b45fce833e409 }
$a_28 = { 558bec518945fc8b45fc8b8024020000 }
$a_29 = { 558bec83c4e4538945fcb201a138ff4b }
$a_30 = { 558bec83c4f88b45088b108b4a084989 }
condition:
24 of them
}
rule BackdoorWin32Comfoo_db25d2b99ea457a0fb0a2872ced7419f4315801bc57bfe2fa5c7da6cfd6749b2 {
strings:
$a_2 = { 558bec6aff68d8120110681807011064 }
$a_3 = { 558bec6aff6888130110681807011064 }
$a_4 = { 558bec83ec20568bf1576898300110c7 }
$a_5 = { 558bec6aff684b0a011064a100000000 }
$a_6 = { 558bec6aff6818130110681807011064 }
$a_7 = { 558b6c240c568bd1578db3160100008b }
$a_8 = { 558b2d60100110568b352c100110578b }
$a_9 = { 558bac24100100008bd985ed750d5d33 }
$a_10 = { 558bf0ff15141201106a018bd8ff1514 }
$a_11 = { 558bac242401000056578bbc24200100 }
$a_12 = { 558be956578b85201500008d9d201500 }
$a_13 = { 558b2dc811011033c98bfb8a8c069401 }
$a_14 = { 558b6c240c56578b7c241c33f68bc76a }
$a_15 = { 558b2d9810011056576a406800100000 }
$a_16 = { 558bac241001000056578bfdf2aef7d1 }
$a_17 = { 558bec6aff68c8120110681807011064 }
$a_18 = { 558b2d701001108d9424400100008d84 }
$a_19 = { 558bac24c0010000565755536a596800 }
$a_20 = { 558b6c24145685ed578bd9b801000000 }
$a_21 = { 558bec6aff68c8130110681807011064 }
$a_22 = { 558bec6aff685031400068102f400064 }
$a_23 = { 558bec6aff6888120110681807011064 }
$a_24 = { 558bec6aff6898130110681807011064 }
$a_25 = { 558bec6aff6838130110681807011064 }
$a_26 = { 558bec6aff688031400068102f400064 }
$a_27 = { 558bec6aff68600b011064a100000000 }
$a_28 = { 558bec6aff6848130110681807011064 }
$a_29 = { 558bec6aff68b8120110681807011064 }
$a_30 = { 558bec6aff6868130110681807011064 }
condition:
24 of them
}
rule BackdoorWin32Coolvidoor_ae40d3ef44fe0f4b18be67af7aebd41798430cd83ee838ec387360c439adfecd {
strings:
$a_2 = { 558bec33c98a4d0c8b45088b5510e8b9 }
$a_3 = { 558bec81c430feffff53565733d28955 }
$a_4 = { 558bec51538945fc8b45fce82c1bfbff }
$a_5 = { 558bec515356578bf28bd8803dc49546 }
$a_6 = { 558bec33c0556898f3410064ff306489 }
$a_7 = { 558bec33c951515151538845ff33c055 }
$a_8 = { 558bec53565733c05568009a410064ff }
$a_9 = { 558bec6a006a0053565733c055688a3f }
$a_10 = { 558bec33c055681d5f440064ff306489 }
$a_11 = { 558bec81c468feffff535657c7054097 }
$a_12 = { 558bec53568b5d088d430450e827aeff }
$a_13 = { 558bec33c055689146410064ff306489 }
$a_14 = { 558bec6a006a00538bd833c05568663b }
$a_15 = { 558bec538bd88bc3e82b27ffff506a00 }
$a_16 = { 558bec33c05568c181440064ff306489 }
$a_17 = { 558bec33c0556838e2400064ff306489 }
$a_18 = { 558bec8b45088078fe0075548b450880 }
$a_19 = { 558bec81c4ecfdffff53565733d28995 }
$a_20 = { 558bec535657bf88984600833f00756c }
$a_21 = { 558bec515356578bd88bc3e89cd3faff }
$a_22 = { 558bea8bf88bc7e89dc5ffff8bf0bb01 }
$a_23 = { 558bec33c05568a4c8410064ff306489 }
$a_24 = { 558bec83c4f8538bd8c645ff00e86201 }
$a_25 = { 558bec83c4bc53565733c9894dd48855 }
$a_26 = { 558bec33c055682d6c400064ff306489 }
$a_27 = { 558bec5153568bd98955fc8b45fce815 }
$a_28 = { 558bec83c4d853a168964600a3344446 }
$a_29 = { 558bec6a0033c05568329f420064ff30 }
$a_30 = { 558bec5331db89c1dd4508d88ba04146 }
condition:
24 of them
}
rule BackdoorWin32CosmicDuke_98ada71f27db039a6f7532a8d35832397428bf4e24dc2f4ba6b658bfa10d500e {
strings:
$a_2 = { 558bec33c08a88b8ba45003a4d087409 }
$a_3 = { 558bec5de9c01c00008bff558bece815 }
$a_4 = { 558bec5633f6393574794e007422e813 }
$a_5 = { 558bec53568b35a4704500578b7d0857 }
$a_6 = { 558bec51894dfce8842500008b4dfc66 }
$a_7 = { 558bec6aff687049450064a100000000 }
$a_8 = { 558bec83ec105356ff75108d4df0e8f1 }
$a_9 = { 558bec6aff68d45f450064a100000000 }
$a_10 = { 558bec8d450c506a00ff7508e811da00 }
$a_11 = { 558bec83ec4c568d45b450ff15d87045 }
$a_12 = { 558bec83ec308365dc008365e000568b }
$a_13 = { 558bec833d584146000075065de91880 }
$a_14 = { 558bec33c03905ec684e007527394508 }
$a_15 = { 558bec6aff685856450064a100000000 }
$a_16 = { 558bec6aff68d85c450064a100000000 }
$a_17 = { 558bec51894dfc8b4dfc83c104e81a9e }
$a_18 = { 558bec51894dfc8b45fc833800751768 }
$a_19 = { 558bec83ec10a10c47460033c58945fc }
$a_20 = { 558bec568bf085f6745b837e38007455 }
$a_21 = { 558bec8b4d0885c97515e886bdffffc7 }
$a_22 = { 558becff750c6a0a6a00ff7508e88329 }
$a_23 = { 558bec6aff68005a450064a100000000 }
$a_24 = { 558bec83ec105753e8130e02008365f8 }
$a_25 = { 558bec51894dfc8b4dfce8912800008b }
$a_26 = { 558bec83ec10a188764e0033d253568b }
$a_27 = { 558becff35a0734e00ff15bc70450085 }
$a_28 = { 558bec83ec08894df88b4d08e82faeff }
$a_29 = { 558bec51894dfc8b45fcc70004ad4500 }
$a_30 = { 558becf745080001000056578bf0747a }
condition:
24 of them
}
rule BackdoorWin32Cyspetel_45ed7d8b5f4248745056636020ff0c3fc561490f56c92b7e872f50fafb9b120c {
strings:
$a_2 = { 558bec83ec34a15452460033c58945fc }
$a_3 = { 558bec6aff68bb2f450064a100000000 }
$a_4 = { 558bec6aff68502e450064a100000000 }
$a_5 = { 558bec83ec0c56894df48d4dfc3bca75 }
$a_6 = { 558b6c24182bc1555003ca51e8b03b00 }
$a_7 = { 558bec83ec10ff75088d4df0e82319ff }
$a_8 = { 558bec6aff680b30450064a100000000 }
$a_9 = { 558bec83ec305356ff75088d4dd0e88a }
$a_10 = { 558bec5383f800730a5053505b5833d8 }
$a_11 = { 558bec83ec18565733ff68445445008d }
$a_12 = { 558bec83ec10a1545246008365f80083 }
$a_13 = { 558bec6aff685936450064a100000000 }
$a_14 = { 558b6c2408568bf08bc5e8b1fdffff8b }
$a_15 = { 558b6c2410396b1456578bf17305e81e }
$a_16 = { 558bec83ec0c53894df433c0e81ffcff }
$a_17 = { 558bec83ec18dd0538144600dd5df0dd }
$a_18 = { 558bec83ec1053ff75148d4df0e839d6 }
$a_19 = { 558bec6aff68f83c450064a100000000 }
$a_20 = { 558bec5633f63935b86f460075393975 }
$a_21 = { 558bec6aff68102e450064a100000000 }
$a_22 = { 558bc62bc73b442428c606000f825102 }
$a_23 = { 558bec6aff685133450064a100000000 }
$a_24 = { 558bec51518d45f850ff15bc5145008b }
$a_25 = { 558bcee83e0700008b7e043b7e087605 }
$a_26 = { 558be98b85483500005683e81057c745 }
$a_27 = { 558bec6aff682f3e450064a100000000 }
$a_28 = { 558bec535657556a006a0068e4d44100 }
$a_29 = { 558b6c24345633f6578974240c8d7c24 }
$a_30 = { 558bec83e4f883ec0c538bd98b4b0485 }
condition:
24 of them
}
rule BackdoorWin32Damatak_69448f5af54c4c1193e750ea2558c0c410682ee5a4a1123a61fb686b6085f7ae {
strings:
$a_2 = { 558bec83ec108b45085356578b483c33 }
$a_3 = { 558bec83ec1c57ff750cff7508e87e00 }
$a_4 = { 558bec83ec108b4d085356578b793c03 }
$a_5 = { 558bec68bc424000ff7508e880ffffff }
$a_6 = { 558bec8b45088bc881e1ff0f00002bc1 }
$a_7 = { 558bec83ec18538b5d0833d2565733f6 }
condition:
6 of them
}
rule BackdoorWin32Darkddoser_87bf24454baeaeb2c337799af718f6e4eb48d6c75b7847d69dd242ea1da701fc {
strings:
$a_2 = { 558b9ff4e0d4001e7d10a400c9231f22 }
$a_3 = { 558be88db5bb444e83c60481e6826db1 }
condition:
2 of them
}
rule BackdoorWin32Darkddoser_8cd8efcc2d3a05c53d93c3493e1605ec719a9c6e96875a55ae4111fdcc784273 {
strings:
$a_2 = { 558bec6a00538bd833c05568be384100 }
$a_3 = { 558bec81c490f9ffff53565733c08945 }
$a_4 = { 558bec6a005633c055683300410064ff }
$a_5 = { 558bec33c05568beaa400064ff306489 }
$a_6 = { 558bec83c4ec535657bef0154200c706 }
$a_7 = { 558bec33c0556807ad400064ff306489 }
$a_8 = { 558bec6a0033c05568c62c410064ff30 }
$a_9 = { 558bec518945fc33d25568f85e400064 }
$a_10 = { 558bec6a00538bd833c0556872384100 }
$a_11 = { 558bc3e81df8ffff59eb0c55b860f340 }
$a_12 = { 558bec6a0033c055682231410064ff30 }
$a_13 = { 558bec5356578bf98bda8bf08bc6e8e1 }
$a_14 = { 558bec538bd88bc3e86fe9feff506a00 }
$a_15 = { 558bec6a00535633c0556889ff400064 }
$a_16 = { 558bec51535657a1d007420085c07451 }
$a_17 = { 558bec6a0033c05568b62d410064ff30 }
$a_18 = { 558bec33c05568441d410064ff306489 }
$a_19 = { 558bec83c4f85356578945fca138d041 }
$a_20 = { 558bec33c055681590410064ff306489 }
$a_21 = { 558bec6a0033c05568d62b410064ff30 }
$a_22 = { 558bec6a006a00538bd833c055688599 }
$a_23 = { 558bec515356578945fc33d25568ef3b }
$a_24 = { 558bec33c055685baf410064ff306489 }
$a_25 = { 558be98bda8bc5e855a0feff8bc3e8ba }
$a_26 = { 558bec33c055685dc2400064ff306489 }
$a_27 = { 558bec5356beb836420068bc364200e8 }
$a_28 = { 558bec33c05568af7e410064ff306489 }
$a_29 = { 558bec83c4f85356578bda85db780ac1 }
$a_30 = { 558bec33c05568bb63400064ff306489 }
condition:
24 of them
}
rule BackdoorWin32DarkView_af549aaeb006eb38b759046e7ac977dd0f7a541b621124ded929f20cd0de6e76 {
strings:
$a_2 = { 5589e5ff75146a006a00ff7510ff750c }
$a_3 = { 5589e5515356578b451c8945fc8b550c }
$a_4 = { 5589e583ec0c57a1888f01108b158c8f }
$a_5 = { 5589e583ec405356578b7d08c745c007 }
$a_6 = { 5589e5578b7d08ff37e85cefffff837f }
$a_7 = { 5589e583ec0452a10474011050ff152c }
$a_8 = { 5589e583ec04538b5d0831c985db7455 }
$a_9 = { 5589e5ff750cff7508e88afaffff83c4 }
$a_10 = { 5589e553578b7d08578b1fff530857e8 }
$a_11 = { 5589e551505356578b45142b45108945 }
$a_12 = { 5589e55150535657ff3574af0110e84f }
$a_13 = { 5589e55157ff7508ff354caf0110e85e }
$a_14 = { 5589e553578b7d088b07c74014360000 }
$a_15 = { 5589e5515057833d34900110007568e8 }
$a_16 = { 5589e583ec045356578b5d0ca1047401 }
$a_17 = { 5589e55356578b750831db6858af0110 }
$a_18 = { 5589e583ec0c5356578b7d088bb75c01 }
$a_19 = { 5589e557ff35f4af0110e8ea01000089 }
$a_20 = { 5589e5515356578b45088b308b7e1431 }
$a_21 = { 5589e583ec1c57ff3578af0110e8b737 }
$a_22 = { 5589e556578b750868d800000056e8b3 }
$a_23 = { 5589e556578b7d088bb74c01000068d8 }
$a_24 = { 5589e583ec04538b5d0c85db743689da }
$a_25 = { 5589e56a01ff750cff7508e8b4feffff }
$a_26 = { 5589e583ec205356578b7d0c8b470889 }
$a_27 = { 5589e56aff8b4508ff30e875efffff5d }
$a_28 = { 5589e5515056578365fc008365f800ff }
$a_29 = { 558b45f88378040074106a018d45ff50 }
$a_30 = { 5589e58b4508ff700c6a00ff35fca601 }
condition:
24 of them
}
rule BackdoorWin32Daromec_61c75644f85769564ac086c838c7dc66f98eb7b402a6ad289adf6628aec3d25a {
strings:
$a_2 = { 558b736120653a9b382c3ae1bd61c2c5 }
$a_3 = { 558bb243ec9af933712d6c3d5099233b }
$a_4 = { 558b941031eec165a4778b9d788fe617 }
$a_5 = { 558b914e9b9ae8b2916bc46c98c84e06 }
$a_6 = { 558bd58bd98bdc8abb17bb17b921b62f }
$a_7 = { 558bff005a7cfd006f69fe00dbdaf100 }
$a_8 = { 558ba5466fbe07c5b972a2da87e3af96 }
$a_9 = { 558b04b1a0e7d8cc6aea5fbe8c2469a7 }
$a_10 = { 558b53504acd261d9d1bd68299718b42 }
$a_11 = { 558b35b8fdc5e32656f29080a7a3603d }
$a_12 = { 558ba5fdb795fc9debb8e4ed0ab523dc }
$a_13 = { 558b2d7c2fd210e0854f6c013f699fc4 }
$a_14 = { 558b885beb5eb7d677baade1f5abc6d7 }
$a_15 = { 558b4fd9ecc5d03e5c3f8dd15d7a6b5a }
$a_16 = { 558bc7ebbf2a692128c0f78574f9fb15 }
$a_17 = { 558b69ae1d04ebc45df35633bc3e8ead }
$a_18 = { 558bbde6b96cf23b24d88df02936796a }
$a_19 = { 558bb90ea0093748249ffa48f76c8d2b }
$a_20 = { 558bcf6547f49edb868d516a6b0fd178 }
$a_21 = { 558b2edba0384af24a8c9078be4f73ca }
condition:
17 of them
}
rule BackdoorWin32Daserf_a51e4d5810182b75374e467c844141672ffb5a54a3fea781cc5aa58086cf7f07 {
strings:
$a_2 = { 558bec81ec000400005633f6680d2d66 }
$a_3 = { 558bec81ec040400005356be787f6632 }
$a_4 = { 558bec51834dfcff8d45fc56506a20ff }
$a_5 = { 558bec81ec000900008b450c568b352c }
$a_6 = { 558bec6aff68f851663268404d663264 }
$a_7 = { 558bec51518b4514568b750c33d28910 }
$a_8 = { 558bec578b7d1485ff7e1f8a4510b103 }
$a_9 = { 558becb898640000e8e0050000535657 }
$a_10 = { 558bec81ec700400005356576a0f59be }
$a_11 = { 558becb810110000e8661e0000535657 }
$a_12 = { 558bec83ec148b451053568b750c85c0 }
$a_13 = { 558becb814280000e8e12300005333db }
$a_14 = { 558bec8b45105633d28b483c8b70208b }
$a_15 = { 558bec81ecfc05000053568d8524ffff }
$a_16 = { 558bec51578b7d0885ff750733c0e99a }
$a_17 = { 558bec81ec240100008b4d1053568b75 }
$a_18 = { 558bec83ec2c8d45f4684460663250ff }
$a_19 = { 558bec81ec0c08000053565768f40100 }
$a_20 = { 558bec81ecb8060000568b75085756c7 }
$a_21 = { 558bec81ec6001000056578d45a46844 }
$a_22 = { 558bec83ec545633f66a448d45ac5650 }
$a_23 = { 558bec83ec105633f6837d1001c745f0 }
$a_24 = { 558becb86c130000e8512d0000535657 }
$a_25 = { 558becb804380000e8a61f0000535657 }
$a_26 = { 558becb814280000e80c2200005333db }
$a_27 = { 558bec8b4d0833c03945107e10803c08 }
$a_28 = { 558bec83ec10568b35ec5066328d45f0 }
$a_29 = { 558bec81ec880200005356be04010000 }
$a_30 = { 558bec8b450833d2f7750c8b450885d2 }
condition:
24 of them
}
rule BackdoorWin32Death_51544109d63a2b531b399e4e9bcb4c38a35acd121c66f48d8c4c209cc1695465 {
strings:
$a_2 = { 558bd9662d0449bdc06a04a31dd89b9f }
condition:
2 of them
}
rule BackdoorWin32Defsel_8188cbd87d8f427a0ce2ef93087d7532980fc23a718bef36a54c863997d1cd1e {
strings:
$a_2 = { 558bec33c05568e5d2141364ff306489 }
$a_3 = { 558bce2bcb418bd38bc7e874e2ffff5d }
$a_4 = { 558bec51538945fc8b45fce8bc5dffff }
$a_5 = { 558bec81c4ccfeffff535633d28995cc }
$a_6 = { 558bece8a0f7ffff5531c96874271413 }
$a_7 = { 558bec51535684d2740883c4f0e872a4 }
$a_8 = { 558bec538b5d085368b1d70000686419 }
$a_9 = { 558bec53568bda8bf08bc3ba8c041513 }
$a_10 = { 558bec33c05568fb07151364ff306489 }
$a_11 = { 558bec51538945fc8b45fce88cecffff }
$a_12 = { 558bec6a0053565733c055680c121513 }
$a_13 = { 558bec33c05568cdbd141364ff306489 }
$a_14 = { 558bec33c05568c105151364ff306489 }
$a_15 = { 558bf28bd88bc6e8f5eaffff8bf88bc3 }
$a_16 = { 558bec33c055687939141364ff306489 }
$a_17 = { 558bec81c484feffff5333db899d84fe }
$a_18 = { 558bec51538bda8945fc8b45fce83a75 }
$a_19 = { 558bec51538945fc8b45fce85c73ffff }
$a_20 = { 558bec83c4f853568855fb8945fc8b45 }
$a_21 = { 558bec538bd18a4d088b18ff135b5dc2 }
$a_22 = { 558bec51538bd86a208bcaa150561413 }
$a_23 = { 558bec33c05568854f141364ff306489 }
$a_24 = { 558bec33c055682d5f141364ff306489 }
$a_25 = { 558bec83c4e053568bd86a006a006a00 }
$a_26 = { 558bec33c05568413f141364ff306489 }
$a_27 = { 558bec83c4f8538bd8c645ff006a64e8 }
$a_28 = { 558bec5153568b45088b40fc668b400a }
$a_29 = { 558bec33c05568236e151364ff306489 }
$a_30 = { 558bec33c05568996e151364ff306489 }
condition:
24 of them
}
rule BackdoorWin32Degrub_1aeacd8b53d335bc3294db905581a37e2233ec615ebaf0cbc360fafdbee30f79 {
strings:
$a_2 = { 558bec6a00538bd833c0556809204500 }
$a_3 = { 558bec81c444fdffff535633c9898d64 }
$a_4 = { 558bec33c0556841a1420064ff306489 }
$a_5 = { 558bec535657833decfb490000743c33 }
$a_6 = { 558bec33c05568e512430064ff306489 }
$a_7 = { 558bec33c0556823bc490064ff306489 }
$a_8 = { 558bec83c4f8538945fc8b45fce8b652 }
$a_9 = { 558bec8b4508e8ed2cf9ff5dc38d4000 }
$a_10 = { 558bec83c4f8e875e7feff8855fb8945 }
$a_11 = { 558bec33c0556875ee430064ff306489 }
$a_12 = { 558bec33c05568b1c7420064ff306489 }
$a_13 = { 558bec8b4508508b450c505152a110e4 }
$a_14 = { 558bec515356578945fc33c055681ef5 }
$a_15 = { 558bec8b4508508b450c505152a1ece4 }
$a_16 = { 558bec535657ff750833c055687f7648 }
$a_17 = { 558bec515356578945fc33c05568628e }
$a_18 = { 558bec81c468feffff535657c70544f7 }
$a_19 = { 558bec6a0033c055680fa3460064ff30 }
$a_20 = { 558bec33c05568352e480064ff306489 }
$a_21 = { 558bec6a005333c05568e2e4400064ff }
$a_22 = { 558b1c2485db742f8bc366bed6ffe8ac }
$a_23 = { 558bec33c05568b5ca460064ff306489 }
$a_24 = { 558bec33c05568494d490064ff306489 }
$a_25 = { 558bec5356578bf8a168f84900e85ac8 }
$a_26 = { 558bec6a0033c0556856f1400064ff30 }
$a_27 = { 558bec6a0033c05568ce0e470064ff30 }
$a_28 = { 558bec5356a16cfb4900837804000f95 }
$a_29 = { 558bec535657bf38f649008b470885c0 }
$a_30 = { 558bec5356578b7d10803d33f9490000 }
condition:
24 of them
}
rule BackdoorWin32Dekara_c95e5a9b1d31ba0585abc075172a608338874af76b942b33dbd6877c3b14b3f9 {
strings:
$a_2 = { 558bec5356578bd98bfa8bf08bc3e851 }
$a_3 = { 558becbae0ad4800b898ba4500e862f3 }
$a_4 = { 558bec53565784d2740883c4f0e8eec9 }
$a_5 = { 558becba58ae4800b8d4c24500e82eeb }
$a_6 = { 558bec83c4f85356578945fca1403048 }
$a_7 = { 558be98bda8bf88bc7e8ff28f9ff8bf0 }
$a_8 = { 558becbaccad4800b860b94500e896f4 }
$a_9 = { 558bec6a006a005333c0556863b74700 }
$a_10 = { 558bec53568bf28bd8a1bca94800e801 }
$a_11 = { 558becbaa4ae4800b81cc84500e8dae5 }
$a_12 = { 558b45fce862e3feffe8f1feffff5988 }
$a_13 = { 558bec51568bf06a208bcaa1703b4100 }
$a_14 = { 558bec5153bb50ab4800a158ab4800e8 }
$a_15 = { 558beca178554800e8cfbdffff5dc204 }
$a_16 = { 558becba18ae4800b868be4500e892ef }
$a_17 = { 558becba5cad4800b85cb24500e8aafb }
$a_18 = { 558bea33db33ff8bc5e85b47faff8bf0 }
$a_19 = { 558bec6a00538bda33c05568f0734600 }
$a_20 = { 558becbad4ad4800b8dcb94500e816f4 }
$a_21 = { 558be833db8b7d108b750c2bf77f174e }
$a_22 = { 558becbabcad4800b840b84500e8c2f5 }
$a_23 = { 558bec6a0033c055687129480064ff30 }
$a_24 = { 558bec83c4f48d55f4e8eec9ffff8945 }
$a_25 = { 558becba28ad4800b880af4500e87afe }
$a_26 = { 558becba70ae4800b88cc44500e86ee9 }
$a_27 = { 558becba7cae4800b870c54500e88ee8 }
$a_28 = { 558bec6a0053568bda33d25568ad5646 }
$a_29 = { 558bec84d2740883c4f0e819ecfeff89 }
$a_30 = { 558bec518945fc8b45fc80781800745d }
condition:
24 of them
}
rule BackdoorWin32Delf_ba96134c6b34993b07c658c5d0859fd8dd7d00454480f096e7b95b9c6815cf45 {
strings:
$a_2 = { 558b27f9a94557b8e4a32ba99aae5a02 }
$a_3 = { 558b8e4ed6d907a3f553c39d302bdd62 }
$a_4 = { 558bce686dcf44338dff5462a5766ffb }
condition:
3 of them
}
rule BackdoorWin32Deppeels_28d2f5a7f3e93056d7cf6a955a042d4a0af45335cc80e548627079bf221be4d5 {
strings:
$a_2 = { 558bec83ec0c894dfc837d080074538b }
$a_3 = { 558bec83ec34a15c43420033c58945fc }
$a_4 = { 558bec56ff75088bf1e8afd9ffffc706 }
$a_5 = { 558bec5151535633f6578b3d30504200 }
$a_6 = { 558becff7508ff1500f1410085c07506 }
$a_7 = { 558bec5153568bf033db3bf3751ee84c }
$a_8 = { 558bec535657556a006a0068dce64000 }
$a_9 = { 558bec5356578b7d08837f2000bb184c }
$a_10 = { 558bec6aff68a061001068b658001064 }
$a_11 = { 558bec5151a15c43420033c58945fca1 }
$a_12 = { 558bec81ec1c02000053565733db33c0 }
$a_13 = { 558bec83ec4ca15c43420033c58945fc }
$a_14 = { 558bec686cfa4100ff1500f1410085c0 }
$a_15 = { 558bec51535657ff3508b80010e8e5ca }
$a_16 = { 558bec8b45088b0d4c44420056395004 }
$a_17 = { 558bec81eccc0000008b45088945fc8b }
$a_18 = { 558bec8b450c8a008b4d0888015dc38b }
$a_19 = { 558bece87e2c00008b8098000000eb0a }
$a_20 = { 558bec515156e887ecffff8bf085f60f }
$a_21 = { 558bece83a2c0000ff7508e8872a0000 }
$a_22 = { 558bec833d10b800100074196810b800 }
$a_23 = { 558bec568d4508508bf1e8af0c0000c7 }
$a_24 = { 558bec83ec10ff750c8d4df0e8e832ff }
$a_25 = { 558bec8b4508a3b04142005dc3a1b041 }
$a_26 = { 558bec83ec18a15c4342008365e8008d }
$a_27 = { 558beca15c5a42008a008b4d0884c074 }
$a_28 = { 558bec81ec8c020000c645fb006a006a }
$a_29 = { 558bec6803010000ff7508e8d3120000 }
$a_30 = { 558bec83ec0cc645fb00c745fc000000 }
condition:
24 of them
}
rule BackdoorWin32Dervec_368b4d4c72b08c42734c6e7d8528a83f53a711bd62be1d8b4b2f9c5e2be0b46b {
strings:
$a_2 = { 558bec837d08007515e8e4beffffc700 }
$a_3 = { 558bec83ec10ff750c8d4df0e8ef73ff }
$a_4 = { 558bec568bf1c706a44c0110e88fffff }
$a_5 = { 558bec6afe68607f011068b088001064 }
$a_6 = { 558bec83ec1056ff750c8d4df0e81882 }
$a_7 = { 558bec568b75085756e8eee6ffff5983 }
$a_8 = { 558bec8b450883f8fe7518e89d9bffff }
$a_9 = { 558bec81ec8c060000a14090011033c5 }
$a_10 = { 558bec51a198b2011053568945fce8cd }
$a_11 = { 558bec837d0800750bff750ce84192ff }
$a_12 = { 558bec6afe68b87c011068b088001064 }
$a_13 = { 558bec8b450885c07515e829d9ffffc7 }
$a_14 = { 558bec833dd8910110ff744b837d0800 }
$a_15 = { 558bec83ec10a14090011033c58945fc }
$a_16 = { 558bec51518d45f850ff15204101108b }
$a_17 = { 558bec8b450833c93b04cd4890011074 }
$a_18 = { 558bec568b750856e80c1d000050e8b0 }
$a_19 = { 558bec56e87f240000e87424000050e8 }
$a_20 = { 558bec56ff75088bf1e845140000c706 }
$a_21 = { 558bec8b4508a3acae01105dc38bff55 }
$a_22 = { 558bec83ec7ca14090011033c58945fc }
$a_23 = { 558bec83ec38a14090011033c58945fc }
$a_24 = { 558bec8b4508ff34c550950110ff157c }
$a_25 = { 558bec81ec28010000a14090011033c5 }
$a_26 = { 558bec6afe68607e011068b088001064 }
$a_27 = { 558bec83ec1853ff75108d4de8e879a7 }
$a_28 = { 558bec8b45088b0d444e011056395004 }
$a_29 = { 558becb84d5a000083ec106639067406 }
$a_30 = { 558bec83ec1c568bf0a198b201108b48 }
condition:
24 of them
}
rule BackdoorWin32Dervec_4eb3f3aaadcbd3cba67324b2a153474984c4833e9c7188e3c7e8a1a2373dc122 {
strings:
$a_2 = { 558becff750cff7508ff35f8f24000ff }
$a_3 = { 558bec56e821190000e81619000050e8 }
$a_4 = { 558bec8b4508ff34c580ec4000ff1508 }
$a_5 = { 558bec833dd80d410000741968d80d41 }
$a_6 = { 558bec565733f6ff750cff7508e86039 }
$a_7 = { 558bec833d40e24000ff744b837d0800 }
$a_8 = { 558bec33c08b4d083b0cc550ac400074 }
$a_9 = { 558bec8b4508a3fcfb4000a300fc4000 }
$a_10 = { 558bec83ec10ff75088d4df0e8029bff }
$a_11 = { 558bec8b450833c93b04cdc0e0400074 }
$a_12 = { 558bec8b45088b0dcca3400056395004 }
$a_13 = { 558bec568b7508b850e240003bf07222 }
$a_14 = { 558bec56e85ff9ffff8bf085f60f8432 }
$a_15 = { 558bec83ec10ff750c8d4df0e822b6ff }
$a_16 = { 558bec6afe6828c74000685041400064 }
$a_17 = { 558bec6afe6808c74000685041400064 }
$a_18 = { 558bec8b4508e895ffffff68c8000000 }
$a_19 = { 558bec8b4508568d34c580ec4000833e }
$a_20 = { 558bec8b4508b950e240003bc1721f3d }
$a_21 = { 558bec8b450883f8fe7518e85c95ffff }
$a_22 = { 558bece8c4070000ff7508e80d060000 }
$a_23 = { 558b3383c304899dd8fdffffe8d6adff }
$a_24 = { 558bec8b4508a310fc40005dc38bff55 }
$a_25 = { 558bec8b4508a334f240005dc38bff55 }
$a_26 = { 558bece8c41a000085c0740750e87c1c }
$a_27 = { 558becff3534f24000ff1544a1400085 }
$a_28 = { 558bec837d08007515e8cea2ffffc700 }
$a_29 = { 558bec51833dd0ee4000fe7505e80b06 }
$a_30 = { 558becb8e41a0000e834330000a104e0 }
condition:
24 of them
}
rule BackdoorWin32Deselia_fc27db025e1a6acc79f7227888b2f5cd35f0d2363873db2dace96753968c34bc {
strings:
$a_2 = { 558bec81ec28030000a3a8450010890d }
$a_3 = { 558bec51538bda8bc18945fc85db7446 }
$a_4 = { 558bec81ec1405000033c06806020000 }
$a_5 = { 558bec81ec30010000578bfa894dfc83 }
$a_6 = { 558bec33c039450c750e3905a0440010 }
$a_7 = { 558bec8b5508535633f63bd65774078b }
$a_8 = { 558bec83e4f881ec28020000535633c0 }
$a_9 = { 558bec51b97b0100008da42400000000 }
$a_10 = { 558becff4d0c75088b4508a3c4470010 }
$a_11 = { 558bec837d0c017505e81a0300005de9 }
$a_12 = { 558bec81eca404000033c06806020000 }
$a_13 = { 558bb94d7f52612f1c2c1893a7784ca1 }
$a_14 = { 558bec5356576a006a0068cf13001051 }
condition:
11 of them
}
rule BackdoorWin32Detarmal_7e20cdec9c6eab8975a20a34b8441c1aa2a6f7af6ebcbc752f586a01afdf40ca {
strings:
$a_2 = { 558b6c2428565785ed895c2428750a5f }
$a_3 = { 558bec83ec10566a066a016a02e84230 }
$a_4 = { 558bec6aff6840b340006838a9400064 }
$a_5 = { 558bec83ec108a450c68002000008845 }
$a_6 = { 558bec83ec0c538a5d0c84db750d6a04 }
$a_7 = { 558bec5633f65656565656568d450856 }
$a_8 = { 558becb80c200000e8147100005333db }
$a_9 = { 558bec53568b750c5732dbff366a0068 }
$a_10 = { 558bec81ec5001000053568b750883cb }
$a_11 = { 558bec83ec148d45fc56508d45ec50c7 }
$a_12 = { 558bec5153568b750c5783c9ff33c08d }
$a_13 = { 558bec51568b750c807e0400752e8d45 }
$a_14 = { 558b6c240c568bd9578b45048b750089 }
$a_15 = { 558bec568b7508ff7604ff36ff760cff }
$a_16 = { 558bec81ec08010000833d88dd400000 }
$a_17 = { 558beca1dcde4000538b5d0c5657a3e0 }
$a_18 = { 558bec5633f6ff157cb140003d000000 }
$a_19 = { 558bec83ec288065ff00535657ff7508 }
$a_20 = { 558bec83ec448b450853568b353cb240 }
$a_21 = { 558bec81ec80010000837d0800538b5d }
$a_22 = { 558bec83ec0c568b7514833e000f8482 }
$a_23 = { 558bec0fb6450883e800742848741e48 }
$a_24 = { 558bec83ec0c538365fc0056578b7d14 }
$a_25 = { 558bec5166833d7cdd400000740966ff }
$a_26 = { 558bec81ec08010000a1dcde4000568b }
$a_27 = { 558bcee8a4feffff8b6804578bcee899 }
$a_28 = { 558bec5356578b7d108d34bd84e44000 }
$a_29 = { 558bec83ec2c5332dbff7508ff1588b0 }
$a_30 = { 558bec83ec345356578b7d1083c9ff33 }
condition:
24 of them
}
rule BackdoorWin32Dodiw_1ba51ad3000d73770720245b50688837579f05e2d555d7bda790adef40d20d44 {
strings:
$a_2 = { 558b88ab4d5808d2104663a1bd6a2d2c }
$a_3 = { 558b4a8e2af92ffe2ae43ef35cf53f8d }
condition:
2 of them
}
rule BackdoorWin32Dokstormac_5a2da25adf30dde4b775ab0ccd11e0cef3a48ce8dfca4c995a3426191f14ac37 {
strings:
$a_2 = { 558bec83ec28538b5d0856578bf9895d }
$a_3 = { 558bec515356e868f5ffff8bf0ff7650 }
$a_4 = { 558bec566a1068e0da0202ff750ce8ba }
$a_5 = { 558bf521378625070b58398e9c3745f9 }
$a_6 = { 558bec83ec1c56bef8ca02028b066a02 }
$a_7 = { 558bec6aff6890d2020268101c010264 }
$a_8 = { 558bec6aff6860d2020268101c010264 }
$a_9 = { 558bec6aff68f0d2020268101c010264 }
$a_10 = { 558bec5151568bf1578b3d34a002028b }
$a_11 = { 558bec83ec34e84c4100008945fc8b40 }
$a_12 = { 558b1acc1221d360e5d040fe5801147f }
$a_13 = { 558b8fb98a70ae7e6685b2be918cf8f6 }
$a_14 = { 558bec5151538365fc00568bf157518b }
$a_15 = { 558bec5151568bf1578b3d28a002028b }
$a_16 = { 558b13d6e5c6ac462f00f0a63734334d }
$a_17 = { 558bdabe9791f3a236a4be8315766ddf }
$a_18 = { 558bec515153568b3510940302578b56 }
$a_19 = { 558bec5657ff75088b3de8a20202ffd7 }
$a_20 = { 558bec6aff6878d2020268101c010264 }
$a_21 = { 558bec51833d04c6030200535657751d }
$a_22 = { 558bec6aff68b8d2020268101c010264 }
$a_23 = { 558bc435e55aac07f20ae01e2a0a85e1 }
$a_24 = { 558becb82c120000e8c2b2ffff8d8568 }
$a_25 = { 558bec5151568bf1578b3d74a002028b }
$a_26 = { 558bec83ec4053568b3580a00202576a }
$a_27 = { 558bec6aff68b8d0020268101c010264 }
$a_28 = { 558bec6aff6878d8020268101c010264 }
$a_29 = { 558bec83ec10681b430202b940be0302 }
$a_30 = { 558bec83ec2c5356578bf1e89ee0ffff }
condition:
24 of them
}
rule BackdoorWin32Dorbop_ce3653e7a818ba0c58a49c3019bbc0543dac1745c6f35d0c48c1bfd42a70a6c9 {
strings:
$a_2 = { 558bec5157ff15c45145008bf833c085 }
$a_3 = { 558bec5657e8425cfeff8db09c000000 }
$a_4 = { 558bec81ec0c010000a12878460033c5 }
$a_5 = { 558bec83ec48894df88b4df883c154e8 }
$a_6 = { 558bec8b4508c701b87845008b008941 }
$a_7 = { 558becff7514a11ccf46003305287846 }
$a_8 = { 558becb940a44600e86327fbff5dc3cc }
$a_9 = { 558bec83ec1c894dfc8b45fc83781400 }
$a_10 = { 558bec68e857450068a8574500ff1594 }
$a_11 = { 558bec68f86f450068a8574500ff1594 }
$a_12 = { 558becb938a44600e87340fbff68504e }
$a_13 = { 558bec51518b4d0c568b018b7508683c }
$a_14 = { 558bec6aff685629450064a100000000 }
$a_15 = { 558bec8d450c50ff7508e8307c000059 }
$a_16 = { 558bec51894dfc8b450c50e820030000 }
$a_17 = { 558bec518b45088338027502eb466a01 }
$a_18 = { 558bec568bf1c706b8784500e8770000 }
$a_19 = { 558bec6aff68182d450064a100000000 }
$a_20 = { 558bec680858450068a8574500ff1594 }
$a_21 = { 558bec83ec0c56894dfc8b4dfce82efd }
$a_22 = { 558bec83ec0c6a008d45f8506a00683f }
$a_23 = { 558becff750c6a0a6a00ff7508e89688 }
$a_24 = { 558bec6afe687052460068b0c9410064 }
$a_25 = { 558bec51a12878460033c58945fc8b4d }
$a_26 = { 558beca1fcce46003305287846007408 }
$a_27 = { 558bec6aff68f825450064a100000000 }
$a_28 = { 558bec83ec0c894dfc8b4dfce8eff9ff }
$a_29 = { 558bec83ec10ff75088d4df0e86af6fe }
$a_30 = { 558bec81ec200d0000a12878460033c5 }
condition:
24 of them
}
rule BackdoorWin32Dougat_e5a33efb3f9a55cd2dbe7ce506c6214eae4e37cc41e3d06a570b10099d4046f3 {
strings:
$a_2 = { 558bec81ec0401000056578b7d0c8d85 }
$a_3 = { 558bec81ec1402000053566a01e897fe }
$a_4 = { 558bec81ec680100005356576a1033db }
$a_5 = { 558bec81ec4c03000053568d85f8feff }
$a_6 = { 558bec83ec1c56576a018d45fc5f8bf1 }
$a_7 = { 558bec81ec9c050000a1f84040005356 }
$a_8 = { 558bec81ec7807000057b9a700000033 }
$a_9 = { 558bec81ec6c050000566828414000ff }
$a_10 = { 558becff750cff15603040008b4d0880 }
$a_11 = { 558bec81ecac060000568b750c85f60f }
$a_12 = { 558bec83ec145356578bf168e8404000 }
$a_13 = { 558bec81ec8c04000053566814414000 }
$a_14 = { 558bec81ec48020000565780a5b8fdff }
$a_15 = { 558bec51837d08005356570f84260100 }
$a_16 = { 558bec81ec3c02000056576a0cbe7041 }
$a_17 = { 558bec81ec6c050000536824414000ff }
$a_18 = { 558bec83ec0c568bf16a088d460c50e8 }
$a_19 = { 558bec6aff68d031400068e22e400064 }
$a_20 = { 558bec81ec20020000538d45fc565033 }
condition:
16 of them
}
rule BackdoorWin32Doumol_1c2b06da812090333b40e2b4f168b69f8727d09f0c622787e849449689bf7322 {
strings:
$a_2 = { 558bec538b5d083b1df0ca4700743653 }
$a_3 = { 558bec51535684d2740883c4f0e896bc }
$a_4 = { 558bec6a00538bd833c055683fef4100 }
$a_5 = { 558bec33c05568b1ec420064ff306489 }
$a_6 = { 558bf28bd833ff8bc3e8f707ffff508b }
$a_7 = { 558bec8b450883c00450e8a9b5ffff5d }
$a_8 = { 558bec83c4f85356578945fca1388047 }
$a_9 = { 558bec5633f6f6c21074195150e8fab2 }
$a_10 = { 558bec33c0556835f0460064ff306489 }
$a_11 = { 558bec83c4f4a1840e4800e8984dfeff }
$a_12 = { 558bec6a006a00538bd833c055687c3f }
$a_13 = { 558bec83c4f4535657a1740b48008b10 }
$a_14 = { 558bec538b5d14b201a154e74400e891 }
$a_15 = { 558bec51568bf06a208bcaa17c9e4100 }
$a_16 = { 558bec83c4f8538945fc8b45fcc64010 }
$a_17 = { 558bec33c05568e71e430064ff306489 }
$a_18 = { 558bec33c0556889ee420064ff306489 }
$a_19 = { 558bec83c4f4538955fce8e94dfeff8b }
$a_20 = { 558bec33c055684a91410064ff306489 }
$a_21 = { 558bec538b5d083b1df0ca4700744aa1 }
$a_22 = { 558bec33c0556811dd460064ff306489 }
$a_23 = { 558bec6a00538bd833c0556877764300 }
$a_24 = { 558bec6a0033c055685e60420064ff30 }
$a_25 = { 558bc3e821f8ffff59eb0c55b8802441 }
$a_26 = { 558bec33c055681532420064ff306489 }
$a_27 = { 558bc7e8b2d9ffff50e8a8e7fdff83c4 }
$a_28 = { 558be8a1d80e4800e8506a00008bf04e }
$a_29 = { 558bec33c055680596450064ff306489 }
$a_30 = { 558bec33c055688dce460064ff306489 }
condition:
24 of them
}
rule BackdoorWin32Drateam_d1403cec010a4064769b9b7712301a1090d5860f7f823831d9c270a9544acd0b {
strings:
$a_2 = { 558bec33c055689d59400064ff306489 }
$a_3 = { 558bec81c4ecfdffff53565733d28995 }
$a_4 = { 558bec83c4f8e859caffff8855fb8945 }
$a_5 = { 558bec518945fc8b45fce84d24ffff33 }
$a_6 = { 558bec5356578bd833c0556803014100 }
$a_7 = { 558bec33c055687166400064ff306489 }
$a_8 = { 558bec33c055681897400064ff306489 }
$a_9 = { 558bec33c05568a13d410064ff306489 }
$a_10 = { 558bec515356578bd8c645ff0033c055 }
$a_11 = { 558bec33c055682994400064ff306489 }
$a_12 = { 558b533452e8ccf8ffff897368897358 }
$a_13 = { 558bec8b55088b450c8b4d10e89f65ff }
$a_14 = { 558bec53565733c05568d516410064ff }
$a_15 = { 558bec5153568945fc8b45fc83782800 }
$a_16 = { 558bec52508b450850516a00a1ac6541 }
$a_17 = { 558bec83c4f0538bd833c0a3b4654100 }
$a_18 = { 558bec33c05568ed79400064ff306489 }
$a_19 = { 558bec33c055680dbd400064ff306489 }
$a_20 = { 558bec68b8674100e843e2ffff33c055 }
$a_21 = { 558bec518945fc8b45fce8f588ffff33 }
$a_22 = { 558bec83c4f8535657be246641008b46 }
$a_23 = { 558bec33c055686906410064ff306489 }
$a_24 = { 558bec33c055680693400064ff306489 }
$a_25 = { 558bec6a006a00538bd833c05568ecab }
$a_26 = { 558bec53565733db33d2556889404100 }
$a_27 = { 558bec33c05568f568400064ff306489 }
$a_28 = { 558bec538b5d085368b2d7000068bc2f }
$a_29 = { 558bec33c055683106410064ff306489 }
$a_30 = { 558bec83c4f40fb705105041008945f8 }
condition:
24 of them
}
rule BackdoorWin32Dridex_10eb9f06a1fa57d2af6bbb958f6a05406e4a84fceb138f19b3a17f03784fd8b5 {
strings:
$a_2 = { 558b3c51f5e61320aebba8397841915c }
$a_3 = { 558bac2dfa62b6ea0955a1e1aa706d4e }
$a_4 = { 558b81bb08f6d6759ac3af361301b193 }
$a_5 = { 558b1a3b046ba5d68a8b4ac13c407461 }
$a_6 = { 558b092a9c0afb7bf4a6cc35ceaf9ffb }
$a_7 = { 558b3c3c894d27fc2e5d2653c584f3e5 }
condition:
6 of them
}
rule BackdoorWin32Drixed_3c3b653443adf8b1b1cda39d54c0c57a330a34820022a002a76982796e02fe33 {
strings:
$a_2 = { 558bca545250666fa6cbb0d4cba836b4 }
$a_3 = { 558b4c19945f088b4a5473c09cc781ea }
$a_4 = { 558b83bfc248dfedeed1b8d4a0934b2d }
$a_5 = { 558bff196d1dd07b75a8834791472e78 }
$a_6 = { 558bcb545250636fa6cbacd4cba832b4 }
$a_7 = { 558bc7545220e26fa67829d4bc543324 }
$a_8 = { 558b2de048c2548279a76f764a78d6b3 }
condition:
6 of them
}
rule BackdoorWin32Dropegg_5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a {
strings:
$a_2 = { 5589e551578b7d08897d08c745fcffff }
$a_3 = { 5589e557e81282000083f800750ab8ff }
$a_4 = { 5589e5578b7d08897d08ff750ce83fcc }
$a_5 = { 5589e55150535657c745fc00000000ff }
$a_6 = { 5589e5515657c745fc00000000eb328b }
$a_7 = { 5589e551535657c745fc00000000eb18 }
$a_8 = { 5589e581ec54020000576a026a006a00 }
$a_9 = { 5589e581ec0c01000057c745f4000000 }
$a_10 = { 5589e55153578b7d08897d08ff750ce8 }
$a_11 = { 5589e581ec8c00000056578b7d08897d }
$a_12 = { 5589e581ec8809000057c7857cf6ffff }
$a_13 = { 5589e56aff681ce04000689a10400050 }
$a_14 = { 5589e581ec2c0600005356578dbde5fb }
$a_15 = { 5589e583ec305657c745fc00000000eb }
$a_16 = { 5589e581ec1403000057c785ecfdffff }
$a_17 = { 5589e5576a016829ec4000e878b3ffff }
$a_18 = { 5589e551505357c745fc00000000ff75 }
$a_19 = { 5589e581ec4001000053578dbdc0feff }
$a_20 = { 5589e583ec58535657c745b800000000 }
$a_21 = { 5589e581ec9001000056578b7d14897d }
$a_22 = { 5589e581ec4401000057c785bcfeffff }
$a_23 = { 5589e581ec80000000578b7d08897d08 }
$a_24 = { 5589e583ec305657c745d000000000c7 }
$a_25 = { 5589e557c70500cc400030000000c705 }
$a_26 = { 5589e581ec8004000056578b7d08897d }
$a_27 = { 5589e581ec0801000057c7857cffffff }
$a_28 = { 5589e583ec10578b7d08897df08d3dfe }
$a_29 = { 5589e55150535657ff7508e890920000 }
$a_30 = { 5589e581ec4401000057c745fc000000 }
condition:
24 of them
}
rule BackdoorWin32Duetag_35c42c173c4b150ad28e61dc39fe965ce38d058ce3c298ad49e24093add20ad0 {
strings:
$a_2 = { 558bce31077c0706bc59d39cece42c09 }
condition:
2 of them