银狐样本分析

rule silverfox_msi{strings:$msi_data0001 = "WshShell.Run "cmd.exe /c copy /b C:ww.txt+C:ProgramData1+C:bb.txt C:ee.exe"，0，True"$msi_data0002 = "WshShell.Run "cmd.exe /c cmd.exe /c C:ee.exe"，0，False"condition:all of ($msi_data*)}rule silverfox_exe{strings:$xor_decode ={ 49 FF CF 49 FF C7 E8 2E 8E 00 00 EB 00 F1 4C D7 35 E3 E0 08 C7 18 62 87 DB F8 47 41 30 00 44 30 24 08 44 02 24 08 E2 F6 }condition:$xor_decode}rule silverfox_xml{strings:$str_mutex ="{A30BD1B1-CB43-4604-86F5-56594AEE26A3}"$str_uac_reg = "SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem"$str_uac = "ConsentPromptBehaviorAdmin"$str_360_1 = "360tray.exe"$str_360_2 ="360safe.exe"$str_360_3 ="360sd.exe"$str_360_4 ="Q360SafeMonClass"condition:all of ($str_*)}rule silverfox_rat{strings://43.139.21.74$hex_ip ={34 33 2E 31 33 39 2E 32 31 2E 37 34 }//uiekjxw.net$hex_hostname ={75 69 65 6B 6A 78 77 2E 6E 65 74 }condition:all of ($hex_*)}