Your IP : 216.73.217.17
| Current Path : /usr/local/assp/deluxe/ |
|
|
| Current File : //usr/local/assp/deluxe/grscripts_spam.yara |
rule grscripts_Nemucod_trojan
{
meta:
description = "Nemucod.AYT trojan"
thread_level = 3
strings:
$a = {0E AB 77 C3 55 48 C3 F4 57 56 2F 64 95 15 04 1D}
$b = {E3 11 22 CC A4 54 66 82 4C 21 9E 41 C2 4D 66 E6}
$c = "contact_vcf_98"
condition:
$a and $b and $c
}
rule grscripts_Spam_001
{
meta:
description = "grscripts_Spam_001"
strings:
$a = "samba.makossa"
$b = "you would like to unsubscribe and stop receiving"
$c = "Transporte para todos os shoppings e outlets"
condition:
$a and $b and $c
}
rule grscripts_Spam_002
{
meta:
description = "grscripts_Spam_002"
strings:
$a = "houlink.houter.com"
$b = "FATURAMENTO MINIMO"
$c = "TELEVENDAS"
condition:
$a and $b and $c
}
rule grscripts_Spam_003
{
meta:
description = "grscripts_Spam_003"
strings:
$a = "Npb24gPGh0dHA6Ly9zMzA3OC50LmVu"
$b = "MtRGF5LU1hc3RlcmNsYXNzLWluLUx1e"
$c = "Discover the secrets of Luxury"
condition:
$a and $b and $c
}
rule grscripts_Spam_004
{
meta:
description = "grscripts_Spam_004"
strings:
$a = "NUWVBFIGh0bWw+DQo8aHRtbD4NCjxoZWFkPg0KPCEtLSBT"
$b = "lsZT0iY29sb3I6ICMwMDAwMDA7IGZvbnQtZmFtaWx5OiB"
$c = "3I6ICMwMDAwMDA7IGZvbnQtZm"
condition:
$a and $b and $c
}
rule grscripts_Spam_005
{
meta:
description = "grscripts_Spam_005"
strings:
$a = "Descontinuados Overstock"
condition:
$a
}
rule grscripts_Spam_006
{
meta:
description = "grscripts_Spam_006"
strings:
$a = "your registration is near complete"
$b = "suiza schauspiel"
$c = "birthday top"
condition:
$a and $b and $c
}
rule grscripts_Spam_007
{
meta:
description = "grscripts_Spam_007"
strings:
$a = {18 E1 02 8E 10 64 0E 38 11 84 10 58 47 D1 00 D8}
$b = {4A AE B3 6C CD 3D 97 CC 97 D3 A8 61 80 0C 92 8A}
$c = {3B 20 30 49 23 08 00 1D 94 0C 41 90 80 20 02 07}
condition:
$a and $b and $c
}
rule grscripts_Spam_008
{
meta:
description = "grscripts_Spam_008"
strings:
$a = {10 18 03 88 24 1F 62 60 0E 29 58 9B 50 38 01 2B}
$b = {52 69 45 24 61 A8 DE 70 C7 2A 3C 60 4E E8 3D A9}
$c = {E3 48 F4 C4 74 FF 00 A5 FF 00 7A 70 67 D0 76 EA}
condition:
$a and $b and $c
}
rule grscripts_Spam_009
{
meta:
description = "grscripts_Spam_009"
strings:
$a = "Finance degree"
$b = "just click"
condition:
$a and $b
}
rule grscripts_Spam_010
{
meta:
description = "grscripts_Spam_010"
strings:
$a = "genomi-k.net"
$b = "rolation.com"
$c = "grouchofractal.com"
$d = ".bossut."
condition:
$a or $b or $c
}
rule grscripts_Spam_011
{
meta:
description = "grscripts_Spam_011"
strings:
$a = {B6 07 DF 2A 69 00 00 20 00 49 44 41 54 78 DA ED}
$b = {6F A1 4A C2 4F 3B 19 1D 60 86 F3 DA 60 34 1E 4F}
$c = {E8 62 AF 07 F7 BD 76 AF 03 47 BD 0E 0D 9C D4 40}
condition:
$a and $b and $c
}
rule grscripts_Spam_012
{
meta:
description = "grscripts_Spam_012"
strings:
$a = {38 10 4B 20 1E 97 97 37 1D 62 65 2A C4 E6 E9 DF}
$b = {99 27 1A C9 0B B3 61 B3 64 73 69 42 EC 53 90 15}
$c = {18 44 B4 18 E5 C1 86 AC 73 61 13 02 DE BF D1 85}
condition:
$a and $b and $c
}
rule grscripts_Spam_013
{
meta:
description = "grscripts_Spam_013"
strings:
$a = "Young naughty girl is seeking a real guy to play exciting games"
condition:
$a
}
rule grscripts_Spam_014
{
meta:
description = "grscripts_Spam_014"
strings:
$a = "Re Viagra Cialis Levitra"
$b = "Viagra Cialis Levitra"
$c = "This secret about Trump will shock you"
$d = "Rush Limbaugh Groundbreaking Secrets to Double Your Income"
$e = "Oxfrord University Alzheimer s Dementia are caused by dormant viral infections"
$f = "Save Huge on Ford Fall Sales Event Saving on All Ford Vehicles"
$g = "Mark Cuban makes record deal Shark Tank"
$h = "Homeland Wants Every American To Have One of These"
$i = "This Is Why Constipation Pills Don t Work Learn More"
condition:
$a or $b or $c or $d or $e or $f or $g or $h or $i
}
rule grscripts_Spam_015
{
meta:
description = "grscripts_Spam_015"
strings:
$a = "Online Quiz is a reverse mortgage right for you"
$b = "Proven Effective CPAP Alternative for Snoring and Sleep Apnea"
$c = "Tell your friends about this"
$d = "Clever Shark Tank Product Helps You Fall Asleep"
$e = "Obama Announces HARP Extension Homeowners Can Save Thousands"
$f = "New Probiotic Takes GNC by Storm Older Men and Women BurningFat"
$g = "Vacancy 627"
$h = "Take this quiz to see if you qualify for a reverse mortgage"
$i = "Want to Re Landscape Your Yard Don t Know Where To Start Here s How"
condition:
$a or $b or $c or $d or $e or $f or $g or $h or $i
}
rule grscripts_Spam_016
{
meta:
description = "grscripts_Spam_016"
strings:
$a = {9F 10 C4 20 92 92 26 B6 7A 4F 0C 4A C0 3E B3 7B}
$b = {D8 DE 48 E4 06 9D 96 BB 07 96 23 47 2D 3D 35 5C}
$c = {1A 88 5E D3 66 1B 02 DF 50 B3 D8 76 BD FE 46 AD}
condition:
$a and $b and $c
}
rule grscripts_Spam_017
{
meta:
description = "grscripts_Spam_017"
strings:
$a = {E9 C9 EA 26 C4 44 F1 E5 E9 7B 92 37 03 E3 C8 27}
$b = {FC F5 F2 4C 97 74 54 A6 F6 E9 8C 9D F8 A2 31 C6}
$c = {75 A4 AC B9 4A D8 0C C3 D4 82 64 BA D6 24 92 21}
condition:
$a and $b and $c
}
rule grscripts_Spam_018
{
meta:
description = "grscripts_Spam_018"
strings:
$a = {52 A2 F1 95 35 87 19 89 3E 31 ED 3C 19 45 4A 12}
$b = {A3 34 A7 3B 76 96 51 8C 75 CE BD 58 BF 7B 49 C2}
$c = {5A EB 53 A8 35 46 80 FB 78 E2 3E 49 3C F8 2D B5}
condition:
$a and $b and $c
}