Industroyer_Malware_5

rule Industroyer_Malware_5 {
   meta:
      description = "Detects Industroyer related malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
      id = "52ce21a0-0c72-585c-a805-c5077a7445af"
   strings:
      $x1 = "D2MultiCommService.exe" fullword ascii
      $x2 = "Crash104.dll" fullword ascii
      $x3 = "iec104.log" fullword ascii
      $x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii

      $s1 = "Error while getaddrinfo executing: %d" fullword ascii
      $s2 = "return info-Remote command" fullword ascii
      $s3 = "Error killing process ..." fullword ascii
      $s4 = "stop_comm_service_name" fullword ascii
      $s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of them ) ) or ( all of them )
}