FiveEyes_QUERTY_Malwaresig_20121_cmdDef

rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef {
	meta:
		description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
		id = "2deb73f7-372e-5d29-a077-431ab1967d93"
	strings:
		$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
		$s1 = "<message>Failed to get File Time</message>" fullword ascii
		$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
		$s3 = "<message>Failed to set File Time</message>" fullword ascii
		$s4 = "</commands>" fullword ascii
		$s5 = "<commands>" fullword ascii
		$s6 = "</version>" fullword ascii
		$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
		$s8 = "<message>No Comms. with Driver</message>" fullword ascii
		$s9 = "</error>" fullword ascii
		$s10 = "<message>Invalid File Size</message>" fullword ascii
		$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
		$s12 = "<message>File Size Mismatch</message>" fullword ascii
		$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
		$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
		$s15 = "<dllDepend>None</dllDepend>" fullword ascii
		$s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
		$s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
		$s18 = "<minorType>0</minorType>" fullword ascii
		$s19 = "<code>00001002</code>" fullword ascii
		$s20 = "<code>00001001</code>" fullword ascii
	condition:
		12 of them
}