FiveEyes_QUERTY_Malwareqwerty_20123

rule FiveEyes_QUERTY_Malwareqwerty_20123 {
	meta:
		description = "FiveEyes QUERTY Malware - file 20123.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
		id = "718d80c9-b6bb-5b73-9c17-49e7d6f77210"
	strings:
		$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
		$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
		$s2 = "<name>20123.sys</name>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
		$s5 = "<platform type=\"1\">" fullword ascii
		$s6 = "</plugin>" fullword ascii
		$s7 = "</pluginConfig>" fullword ascii
		$s8 = "<pluginConfig>" fullword ascii
		$s9 = "</platform>" fullword ascii
		$s10 = "</lpConfig>" fullword ascii
		$s11 = "<lpConfig>" fullword ascii
	condition:
		9 of them
}