Pasted

rule POSCardStealer_SpyBot {
    meta:
        description = "POSCardStealer SpyBot Malware"
        author = "F. Roth"
        date = "2014-02-10"
        sha256 = "853fb5a2aad2e0533e390cfa5b0f3dfe96a054390cacdc8f4ba844bba20809e4"
        sha256 = "85c04c846b8e4a238b26cd96103a621f82242dd06ce0b8352d8f874c8387e1ae" 
        sha256 = "e02e58cae7e61c4d93392c1a3e5f892d9bd053f28ec58b878c18a15ed2021613" 
    strings:
        $s1 = "[BOT_ENGINE] - INFO - Created MUTEX: \"%s\"" wide
        $s2 = "\\Rescator\\uploader\\Debug\\scheck.pdb"
        $s3 = "data_%d_%d_%d_%d_%d.txt"     
        
        $x1 = "BladeLogic"
        $x1 = "cmd /c net start %s"
        $x2 = "ftp -s:%s"
        $x3 = "PATH: %s"
        $x4 = "cmd.txt"
        $x6 = "COMMAND: %s"
        
    condition:
        1 of ($s*) or 4 of ($x*)
}