Bladabindi_Malware_B64

rule Bladabindi_Malware_B64 {
   meta:
      description = "Detects Bladabindi Malware using Base64 encoded strings"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2016-10-08"
      hash1 = "dda668b0792b7679979e61f2038cf9a8ec39415cc161be00d2c8301e7d48768d"
      id = "7f7023be-b6e1-5e1b-af8a-c413a5438ec8"
   strings:
      $s1 = "XHN5c3RlbTMyXA==" fullword ascii /* base64 encoded string '\system32\' */
      $s2 = "RXhlY3V0ZSBFUlJPUg==" fullword ascii /* base64 encoded string 'Execute ERROR' */
      $s3 = "dHJvamFuLmV4ZQ==" fullword ascii /* base64 encoded string 'trojan.exe' */
      $s4 = "VXBkYXRlIEVSUk9S" fullword ascii /* base64 encoded string 'Update ERROR' */
      $s5 = "RG93bmxvYWQgRVJST1I=" fullword ascii /* base64 encoded string 'Download ERROR' */
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
}