document.write('
  1. /*
  2. This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
  3. */
  4.  
  5. rule TeamViewerControlPanel : TeamViewerController
  6. {
  7. meta:
  8. author = "@benkow_"
  9. date = "2017-11-26"
  10. reference = "https://benkowlab.blogspot.fr/2017/11/rules-22-copypasta-is-made-to-ruin.html"
  11. strings:
  12. $mz = {4D 5A}
  13. $string1 = {54 00 68 00 69 00 73 00 20 00 4F 00 53 00 20 00 69 00 73 00 20 00 6E 00 6F 00 74 00 20 00 73 00 75 00 70 00 70 00 6F 00 72 00 74 00 65 00 64 00 21 00 21 00 21 00 00 00}
  14. $string2 = {54 00 56 00 20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 20 00 66 00 72 00 6F 00 6D 00 20 00 41 00 64 00 6D 00 69 00 6E 00 21 00 21 00 21 00 00 }
  15. $string3 = {52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6C 00 6C 00 79 00 21 00 21 00 21 00 00 00}
  16. $string4 = "TeamViewer"
  17. condition:
  18. ($mz at 0 and all of ($string*) )
  19. }
');