rendered paste body[RULESET.0001]
IMPORTRULE.0001 = 1
IMPORTRULE.0002 = 2
DESCRIPTION = "Process32First/Process32Next combination"
------------------------------------------------------------------------
[RULESET.0002]
IMPORTRULE.0001 = 10
IMPORTRULE.0002 = 11
IMPORTRULE.0003 = 12
IMPORTRULE.0004 = 13
DESCRIPTION = "tries gaining higher process privileges"
------------------------------------------------------------------------
[RULESET.0003]
IMPORTRULE.0001 = 5
IMPORTRULE.0002 = 6
DESCRIPTION = "FindFirstFile/FindNextFile combination"
------------------------------------------------------------------------
[RULESET.0004]
IMPORTRULE.0001 = 14
IMPORTRULE.0002 = 15
IMPORTRULE.0003 = 16
IMPORTRULE.0004 = 17
DESCRIPTION = "Possible file dropping functionality"
------------------------------------------------------------------------
[RULESET.0005]
IMPORTRULE.0001 = 3
DESCRIPTION = "Probable dns client/server"
------------------------------------------------------------------------
[RULESET.0006]
IMPORTRULE.0001 = E
DESCRIPTION = "retrieves data from FTP/Gopher/HTTP connection"
------------------------------------------------------------------------
[RULESET.0007]
IMPORTRULE.0001 = 8
DESCRIPTION = "launches an external file using CreateProcess()"
------------------------------------------------------------------------
[RULESET.0008]
IMPORTRULE.0001 = 9
DESCRIPTION = "Creates a mutex"
------------------------------------------------------------------------
[RULESET.0009]
IMPORTRULE.0001 = 4
DESCRIPTION = "Probable smtp client/server"
------------------------------------------------------------------------
[RULESET.000A]
IMPORTRULE.0001 = 7
DESCRIPTION = "sends data over a network connection using send()"
------------------------------------------------------------------------
[RULESET.000B]
IMPORTRULE.0001 = B
DESCRIPTION = "restarts/shuts down computer or logs user off"
------------------------------------------------------------------------
[RULESET.000C]
IMPORTRULE.0001 = C
DESCRIPTION = "terminates a process"
------------------------------------------------------------------------
[RULESET.000D]
IMPORTRULE.0001 = D
DESCRIPTION = "launches an external process using ShellExecute()"
------------------------------------------------------------------------
[RULESET.000E]
IMPORTRULE.0001 = F
DESCRIPTION = "Winsock initialisation"
------------------------------------------------------------------------
[RULESET.000F]
IMPORTRULE.0001 = 18
DESCRIPTION = "deletes a file"
------------------------------------------------------------------------
[RULESET.0010]
IMPORTRULE.0001 = 19
IMPORTRULE.0002 = 1A
DESCRIPTION = "copies a file to windows directory"
------------------------------------------------------------------------
[RULESET.0011]
IMPORTRULE.0001 = 1B
DESCRIPTION = "launches an external process using WinExec()"
------------------------------------------------------------------------
[RULESET.0012]
IMPORTRULE.0001 = A
DESCRIPTION = "retrieves data over a network connection using recv()"
------------------------------------------------------------------------
[RULESET.0013]
IMPORTRULE.0001 = 1C
IMPORTRULE.0002 = 1D
DESCRIPTION = "process injection"
------------------------------------------------------------------------
[RULESET.0014]
IMPORTRULE.0001 = 1E
DESCRIPTION = "writes MZ header to file (dropper)"
------------------------------------------------------------------------
[RULESET.0015]
IMPORTRULE.0001 = 1F
DESCRIPTION = "opens/creates/modifies Run(Once) registry key"
------------------------------------------------------------------------
[RULESET.0016]
IMPORTRULE.0001 = 20
DESCRIPTION = "opens/creates/modifies Run(Once) registry key"
------------------------------------------------------------------------
[RULESET.0017]
IMPORTRULE.0001 = 1C
DESCRIPTION = "process memory modification (injection?)"
------------------------------------------------------------------------
[RULESET.0018]
IMPORTRULE.0001 = 21
DESCRIPTION = "listens for incoming connections"
------------------------------------------------------------------------
[RULESET.0019]
IMPORTRULE.0001 = 1A
IMPORTRULE.0002 = 22
DESCRIPTION = "creates copy of itself"
------------------------------------------------------------------------
[RULESET.001A]
IMPORTRULE.0001 = 23
DESCRIPTION = "possible http client/server"
------------------------------------------------------------------------
[RULESET.001B]
IMPORTRULE.0001 = 24
DESCRIPTION = "uploads data using file transfer protocol (ftp)"
------------------------------------------------------------------------
[RULESET.001C]
IMPORTRULE.0001 = 25
DESCRIPTION = "downloads data using file transfer protocol (ftp)"
------------------------------------------------------------------------
[RULESET.001D]
IMPORTRULE.0001 = 26
DESCRIPTION = "dacl"
------------------------------------------------------------------------
[RULESET.001E]
IMPORTRULE.0001 = 27
DESCRIPTION = "sacl"
------------------------------------------------------------------------
[RULESET.001F]
IMPORTRULE.0001 = 28
DESCRIPTION = "owner"
------------------------------------------------------------------------
[RULESET.0020]
IMPORTRULE.0001 = 29
DESCRIPTION = "group"
------------------------------------------------------------------------
[RULESET.0021]
IMPORTRULE.0001 = 2A
DESCRIPTION = "IsDebuggerPresent() debugger detection"
------------------------------------------------------------------------
------------------------------------------------------------------------
------------------------------------------------------------------------
[IMPORTRULE.0001]
IMPORT.0001 = Process32First
DESCRIPTION = "Process32First"
------------------------------------------------------------------------
[IMPORTRULE.0002]
IMPORT.0001 = Process32Next
DESCRIPTION = "Process32Next"
------------------------------------------------------------------------
[IMPORTRULE.0003]
IMPORT.0001 = htons
IMPORT.0001.PARAMSEQ.0001 = 1
IMPORT.0001.PARAM.0001 = 53
IMPORT.0001.PARAM.0001.TYPE = Immediate
DESCRIPTION = "Probable dns client/server"
------------------------------------------------------------------------
[IMPORTRULE.0004]
IMPORT.0001 = htons
IMPORT.0001.PARAMSEQ.0001 = 1
IMPORT.0001.PARAM.0001 = 25
IMPORT.0001.PARAM.0001.TYPE = Immediate
DESCRIPTION = "Probable smtp client/server"
------------------------------------------------------------------------
[IMPORTRULE.0005]
IMPORT.0001 = FindFirstFile
DESCRIPTION = "FindFirstFile"
------------------------------------------------------------------------
[IMPORTRULE.0006]
IMPORT.0001 = FindNextFile
DESCRIPTION = "FindNextFile"
------------------------------------------------------------------------
[IMPORTRULE.0007]
IMPORT.0001 = send
DESCRIPTION = "sends information over a network connection"
------------------------------------------------------------------------
[IMPORTRULE.0008]
IMPORT.0001 = CreateProcess
DESCRIPTION = "launches an external process"
------------------------------------------------------------------------
[IMPORTRULE.0009]
IMPORT.0001 = CreateMutexA
DESCRIPTION = "creates a mutex"
------------------------------------------------------------------------
[IMPORTRULE.000A]
IMPORT.0001 = recv
DESCRIPTION = "retrieves information over a network connection"
------------------------------------------------------------------------
[IMPORTRULE.000B]
IMPORT.0001 = ExitWindows
DESCRIPTION = "restarts/shuts down computer or logs user off"
------------------------------------------------------------------------
[IMPORTRULE.000C]
IMPORT.0001 = TerminateProcess
DESCRIPTION = "terminates a process"
------------------------------------------------------------------------
[IMPORTRULE.000D]
IMPORT.0001 = ShellExecute
DESCRIPTION = "launches an external process"
------------------------------------------------------------------------
[IMPORTRULE.000E]
IMPORT.0001 = InternetReadFile
DESCRIPTION = "retrieves data from FTP/Gopher/HTTP connection"
------------------------------------------------------------------------
[IMPORTRULE.000F]
IMPORT.0001 = WSAStartup
DESCRIPTION = "Winsock initialisation"
------------------------------------------------------------------------
[IMPORTRULE.0010]
IMPORT.0001 = GetCurrentProcess
DESCRIPTION = "Get current process"
------------------------------------------------------------------------
[IMPORTRULE.0011]
IMPORT.0001 = OpenProcessToken
DESCRIPTION = "opens process token"
------------------------------------------------------------------------
[IMPORTRULE.0012]
IMPORT.0001 = LookupPrivilegeValue
DESCRIPTION = "looks up privilege value"
------------------------------------------------------------------------
[IMPORTRULE.0013]
IMPORT.0001 = AdjustTokenPrivileges
DESCRIPTION = "adjusts privileges"
------------------------------------------------------------------------
[IMPORTRULE.0014]
IMPORT.0001 = FindResource
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0015]
IMPORT.0001 = LoadResource
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0016]
IMPORT.0001 = LockResource
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0017]
IMPORT.0001 = CreateFile
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0018]
IMPORT.0001 = DeleteFile
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0019]
IMPORT.0001 = GetWindowsDirectory
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.001A]
IMPORT.0001 = CopyFile
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.001B]
IMPORT.0001 = WinExec
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.001C]
IMPORT.0001 = WriteProcessMemory
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.001D]
IMPORT.0001 = CreateRemoteThread
DESCRIPTION = "probable process injection"
------------------------------------------------------------------------
[IMPORTRULE.001E]
IMPORT.0001 = WriteFile
IMPORT.0001.PARAMSEQ.0001 = 2
IMPORT.0001.PARAM.0002 = "MZ"
IMPORT.0001.PARAM.0002.TYPE = substring
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.001F]
IMPORT.0001 = RegOpenKey
IMPORT.0001.PARAMSEQ.0001 = 2
IMPORT.0001.PARAM.0002 = "CurrentVersion\Run"
IMPORT.0001.PARAM.0002.TYPE = substring
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0020]
IMPORT.0001 = RegCreateKey
IMPORT.0001.PARAMSEQ.0001 = 2
IMPORT.0001.PARAM.0002 = "CurrentVersion\Run"
IMPORT.0001.PARAM.0002.TYPE = substring
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0021]
IMPORT.0001 = listen
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0022]
IMPORT.0001 = GetModuleFileName
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0023]
IMPORT.0001 = htons
IMPORT.0001.PARAMSEQ.0001 = 1
IMPORT.0001.PARAM.0001 = 80
IMPORT.0001.PARAM.0001.TYPE = immediate
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0024]
IMPORT.0001 = FtpPutFile
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0025]
IMPORT.0001 = FtpGetFile
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0026]
IMPORT.0001 = SetSecurityDescriptorDacl
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0027]
IMPORT.0001 = SetSecurityDescriptorSacl
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0028]
IMPORT.0001 = SetSecurityDescriptorOwner
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.0029]
IMPORT.0001 = SetSecurityDescriptorGroup
DESCRIPTION = ""
------------------------------------------------------------------------
[IMPORTRULE.002A]
IMPORT.0001 = IsDebuggerPresent
DESCRIPTION = ""