rule silverfox_msi{strings:$msi_data0001 = "WshShell.Run "cmd.exe /c copy /b C:\ww.txt+C:\ProgramData\1+C:\bb.txt C:\ee.exe"，0，True"$msi_data0002 = "WshShell.Run "cmd.exe /c cmd.exe /c C:\ee.exe"，0，False"condition:all of ($msi_data*)}rule silverfox_exe{strings:$xor_decode ={ 49 FF CF 49 FF C7 E8 2E 8E 00 00 EB 00 F1 4C D7 35 E3 E0 08 C7 18 62 87 DB F8 47 41 30 00 44 30 24 08 44 02 24 08 E2 F6 }condition:$xor_decode}rule silverfox_xml{strings:$str_mutex ="{A30BD1B1-CB43-4604-86F5-56594AEE26A3}"$str_uac_reg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"$str_uac = "ConsentPromptBehaviorAdmin"$str_360_1 = "360tray.exe"$str_360_2 ="360safe.exe"$str_360_3 ="360sd.exe"$str_360_4 ="Q360SafeMonClass"condition:all of ($str_*)}rule silverfox_rat{strings://43.139.21.74$hex_ip ={34 33 2E 31 33 39 2E 32 31 2E 37 34 }//uiekjxw.net$hex_hostname ={75 69 65 6B 6A 78 77 2E 6E 65 74 }condition:all of ($hex_*)}

# 往期推荐

1、怎么让 IDA 的 F5 支持一种新指令集？

2、2024腾讯游戏安全大赛-安卓赛道决赛VM分析与还原

3、Windows主机入侵检测与防御内核技术深入解析

4、系统总结ARM基础

5、AliyunCTF 2024 - BadApple