PoS_Malware_MalumPOS_Config

rule PoS_Malware_MalumPOS_Config {
   meta:
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2015-06-25"
      description = "MalumPOS Config File"
      reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-malumpos-targets-hotels-and-other-us-industries/"
      id = "0fd2b9c2-d016-5db2-8fcc-618df6c815de"
   strings:
      $s1 = "[PARAMS]"
      $s2 = "Name="
      $s3 = "InterfacesIP="
      $s4 = "Port="
   condition:
      all of ($s*) and filename == "log.ini" and filesize < 20KB
}