Trojan_Raw_Generic_4

rule Trojan_Raw_Generic_4
{
    meta:
        date = "2020-12-02"
        modified = "2020-12-02"
        md5 = "f41074be5b423afb02a74bc74222e35d"
        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
        author = "FireEye"
        id = "9092f9bb-cab6-55c0-9452-70a6407db93a"
    strings:
        $s0 = { 83 ?? 02 [1-16] 40 [1-16] F3 A4 [1-16] 40 [1-16] E8 [4-32] FF ( D? | 5? | 1? ) }
        $s1 = { 0F B? [1-16] 4D 5A [1-32] 3C [16-64] 50 45 [8-32] C3 }
    condition:
        uint16(0) != 0x5A4D and all of them
}