text: import "hash"
  
  rule k3e9_339cf3a9c8000b12
  {
  
     meta:
       copyright="Copyright (c) 2014-2017 Support Intelligence Inc, All Rights Reserved."
       engine="saphire/1.2.4 divinorum/0.992 icewater/0.4"
       viz_url="http://icewater.io/en/cluster/query?h64=k3e9.339cf3a9c8000b12"
       cluster="k3e9.339cf3a9c8000b12"
       cluster_size="7 samples"
       filetype = "pe"
       tlp = "amber"
       version = "icewater foxtail"
       author = "Rick Wesson (@wessorh) rick@support-intelligence.com"
       date = "20171031"
       license = "RIL v1.0 see https://raw.githubusercontent.com/SupportIntelligence/Icewater/master/LICENSE"
       family="backdoor razy injector"
       md5_hashes="['b3c57e3e231e8c14247a241c9d9e93d9', '6482a59d09177c42b9a3179dd3857dc7', '07aca74c1a2c0f59faa9d3e7fcdcb4e2']"
  
  
     condition:
        uint16(0) == 0x5A4D and 
        filesize > 16384 and filesize < 65536 and 
        hash.md5(26112,1536) == "b5ed7b029bc65184d8f3a398fb854e6d"
  }
  
  