Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- rule Sign_azo
- {
- meta:
- description = "Signed azorult"
- author = "James_inthe_box"
- reference = "796e6d59f5cbc3eba40c08c9a4c1002677bbf2be75a7dc3fd779a7f133a49e83"
- date = "2019/01"
- maltype = "Infotealer"
- strings:
- $mz = { 4d 5a }
- $string1 = "GoogleUpdate.exe" wide
- $string2 = "Google Inc." wide
- $string3 = "1.3.29.1" wide
- $string4 = "041904e3" wide
- $string5 = "info@singh-content.co.uk"
- $string6 = "London1806"
- $string7 = "Singh Agile Content Design Limited"
- condition:
- ($mz at 0) and (all of ($string*)) and filesize < 1400KB
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement