FiveEyes_QUERTY_Malwareqwerty_20121

rule FiveEyes_QUERTY_Malwareqwerty_20121 {
	meta:
		description = "FiveEyes QUERTY Malware - file 20121.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
		id = "bf30bdbb-0153-5ae2-bf42-4bd9e4a2f088"
	strings:
		$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
		$s1 = "<name>20121.dll</name>" fullword ascii
		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<platform type=\"1\">" fullword ascii
		$s5 = "</plugin>" fullword ascii
		$s6 = "</pluginConfig>" fullword ascii
		$s7 = "<pluginConfig>" fullword ascii
		$s8 = "</platform>" fullword ascii
		$s9 = "</lpConfig>" fullword ascii
		$s10 = "<lpConfig>" fullword ascii
	condition:
		9 of them
}