Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- rule Punto_loader_bin
- {
- meta:
- description = "Punto loader"
- author = "James_inthe_box"
- reference = "https://app.any.run/tasks/4de0d2c6-7f8d-4db7-baa7-50dd7e49952b"
- date = "2019/02"
- maltype = "Loader"
- strings:
- $mz = { 4d 5a }
- $string1 = "Main Returned."
- $string2 = "Content-Transfer-Encoding: base64"
- $string3 = "Content-Type: multipart/form-data; boundary=%s"
- $string4 = "Accept-Encoding: deflate,gzip"
- $string5 = "Software\\Yandex" wide
- $string6 = "Mozilla/5.0 (Windows NT 10.0; Win32; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.9 Safari/537.36" wide
- $string7 = "klog.php" wide
- condition:
- ($mz at 0) and all of ($string*) and filesize < 800KB
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement