hatman_origaddr

private rule hatman_origaddr : hatman {
    meta:
        id = "b37364d4-928d-556b-9515-9bb944befe8a"
    strings:
        $oaddr_be   = { 3c 60 00 03  60 63 96 f4  4e 80 00 20 }
        $oaddr_le   = { 03 00 60 3c  f4 96 63 60  20 00 80 4e }
    condition:
        $oaddr_be or $oaddr_le
}