rule muma_unpack {   meta:      description = "Tsunami:RAT&DDOS_BOT"      muma_unpack_hash1 = "4410b1cd507926071378c0c470fa98aff12ed4b59ec00766fef8847c72397c26"      muma_hash1 = "6f14afb14e198fc36ff839b09077edb2fb5a55dc9c29c9edcd59075d48255332"   strings:      $x1 = "NOTICE %s :PAN  = An advanced syn flooder that will kill most network drivers" fullword ascii      $x2 = "NOTICE %s :SH = Executes a command" fullword ascii      $x3 = "NOTICE %s :GET = Downloads a file off the web and saves it onto the hd" fullword ascii      $x4 = "NOTICE %s :UDP = A udp flooder" fullword ascii      $x5 = "NOTICE %s :UNKNOWN = Another non-spoof udp flooder" fullword ascii      $s6 = "NOTICE %s :TSUNAMI  = Special packeter that wont be blocked by most firewalls" fullword ascii      $s7 = "NOTICE %s :PAN   " fullword ascii      $s8 = "NOTICE %s :UDP   " fullword ascii      $s9 = "User-Agent: Mozilla/4.75 [en] (X11; U; Linux 2.2.16-3 i686)" fullword ascii      $s10 = "src/process/execve.c" fullword ascii      $s11 = "NOTICE %s :UNKNOWN" fullword ascii      $s12 = "NOTICE %s :TSUNAMI" fullword ascii      $s13 = "NOTICE %s :IRC  = Sends this command to the server" fullword ascii      $s14 = "src/process/posix_spawn_file_actions_adddup2.c" fullword ascii      $s15 = "src/process/posix_spawn_file_actions_destroy.c" fullword ascii      $s16 = "src/process/posix_spawn_file_actions_init.c" fullword ascii      $s17 = "NOTICE %s :Spoofs: %d.%d.%d.%d - %d.%d.%d.%d" fullword ascii      $s18 = "NOTICE %s :Password too long! > 254" fullword ascii      $s19 = "NOTICE %s :Password correct." fullword ascii      $s20 = "src/process/posix_spawn.c" fullword ascii      $y1 = "gent.Mozilla/4.75" fullword ascii      $y2 = "PROT_EXEC|PROT_WRITE failed." fullword ascii      $y3 = "Id: UPX 3.95 Copyright (C) 1996-2018 the UPX Team. All Rights Reserved. $" fullword ascii      $y4 = "NOTICE %s :Unable to comply." fullword ascii      $y5 = "Q USERID" fullword ascii      $y6 = "ooo.User" fullword ascii      $y7 = "KILL  " fullword ascii      $y8 = "no- wi&-FbZ" fullword ascii      $y9 = "" fullword ascii      $y10 = ",7V{ -" fullword ascii      $y11 = "? -[Bo&" fullword ascii      $y12 = "O9/JHTTP/1.0" fullword ascii      $y13 = "liheek" fullword ascii      $y14 = "assifyl" fullword ascii      $y15 = "DEH_FRAME_" fullword ascii      $y16 = "%HTF%3" fullword ascii      $y17 = "toupbr" fullword ascii      $y18 = "%DKz%H" fullword ascii      $y19 = "uvbful" fullword ascii      $y20 = "1-2%S " fullword ascii
   condition:( uint16(0) == 0x457f and filesize < 2000KB and ( 1 of (x*) and 4 of (s*) ) ) or( uint16(0) == 0x457f and filesize < 600KB and ( 8 of (y*) ) ) or ( all of them )}