UnPack_rar_Folder_InjectT

rule UnPack_rar_Folder_InjectT {
   meta:
      description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
      id = "cc7d1a36-1214-5a14-8589-9eb2339a8700"
   strings:
      $s0 = "%s -Install                          -->To Install The Service" fullword ascii
      $s1 = "Explorer.exe" fullword ascii
      $s2 = "%s -Start                            -->To Start The Service" fullword ascii
      $s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
      $s4 = "The Port Is Out Of Range" fullword ascii
      $s7 = "Fail To Set The Port" fullword ascii
      $s11 = "\\psapi.dll" ascii
      $s20 = "TInject.Dll" fullword ascii

      $x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
      $x2 = "injectt.exe" fullword ascii
   condition:
      (1 of ($x*)) and (3 of ($s*))
}