import "pe" rule ATM_Malware_DispenserXFS { meta: description = "Detects ATM Malware DispenserXFS" author = "@Xylit0l @r3c0nst / modified by Florian Roth" reference = "https://twitter.com/r3c0nst/status/1100775857306652673" date = "2019/02/27" score = 80 strings: $xc1 = { 68 FF FF 00 00 68 60 EA 00 00 6A 10 } $s1 = "\\dispenserXFS.pdb" ascii wide $s3 = "C:\\xfsasdf.txt" fullword ascii $s4 = "Injected mxsfs killer into %d." fullword ascii $s5 = "Waiting for freeze msxfs processes..." fullword ascii condition: uint16(0) == 0x5A4D and ( 1 of them or pe.imphash() == "617e037ae26d1931818db0790fb44bfe" ) }