FiveEyes_QUERTY_Malwareqwerty_20120

rule FiveEyes_QUERTY_Malwareqwerty_20120 {
	meta:
		description = "FiveEyes QUERTY Malware - file 20120.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "597082f05bfd3225587d480c30f54a7a1326a892"
		id = "503c71de-1bc5-5690-944c-a60917a4da09"
	strings:
		$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
		$s1 = "<name>20120.dll</name>" fullword ascii
		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<platform type=\"1\">" fullword ascii
		$s5 = "</plugin>" fullword ascii
		$s6 = "</pluginConfig>" fullword ascii
		$s7 = "<pluginConfig>" fullword ascii
		$s8 = "</platform>" fullword ascii
		$s9 = "</lpConfig>" fullword ascii
		$s10 = "<lpConfig>" fullword ascii
	condition:
		all of them
}