text: import "hash"
  
  rule k3e9_3c1a3ec9c4000b14
  {
  
     meta:
       copyright="Copyright (c) 2014-2017 Support Intelligence Inc, All Rights Reserved."
       engine="saphire/1.2.2 divinorum/0.99 icewater/0.3.01"
       viz_url="http://icewater.io/en/cluster/query?h64=k3e9.3c1a3ec9c4000b14"
       cluster="k3e9.3c1a3ec9c4000b14"
       cluster_size="725 samples"
       filetype = "pe"
       tlp = "amber"
       version = "icewater foxtail"
       author = "Rick Wesson (@wessorh) rick@support-intelligence.com"
       date = "20171009"
       license = "RIL v1.0 see https://raw.githubusercontent.com/SupportIntelligence/Icewater/master/LICENSE"
       family="razy simbot backdoor"
       md5_hashes="['40c0af336f1405af896754c42b789a7e', '16be347163cb81d928e338b66e5646d0', 'b5121045e3b33caedab82cde40a6d0f8']"
  
  
     condition:
        filesize > 16384 and filesize < 65536
        and hash.md5(5632,1536) == "b09e1f7c28fc22c6f6859d92fabdae15"
  }
  
  