Update APT_Derusbi.yar

malware/APT_Derusbi.yar

@@ -347,3 +347,28 @@ rule XOR_4byte_Key : APT Derusbi  {
    condition:
       uint16(0) == 0x5a4d and filesize < 900KB and all of them
 }
+
+rule apt_win32_dll_bergard_pgv_pvid_variant : Win32 Derusbi
+{
+
+    meta:
+        copyright = "Fidelis Cybersecurity"
+        reference = "http://www.threatgeek.com/2016/05/turbo-twist-two-64-bit-derusbi-strains-converge.html"
+    strings:
+        $ = "Accept:"
+        $ = "User-Agent: %s"
+        $ = "Host: %s:%d"
+        $ = "Cache-Control: no-cache"
+        $ = "Connection: Keep-Alive"
+        $ = "Cookie: pgv_pvid="
+        $ = "Content-Type: application/x-octet-stream"
+        $ = "User-Agent: %s"
+        $ = "Host: %s:%d"
+        $ = "Pragma: no-cache"
+        $ = "Connection: Keep-Alive"
+        $ = "HTTP/1.0"
+
+    condition:
+
+        (uint16(0) == 0x5A4D) and (all of them)
+}