Update APT_Careto.yar

Fixed rule style

malware/APT_Careto.yar

@@ -4,59 +4,75 @@
 
 import "pe"
 
-rule Careto_SGH : APT Careto  {
-	meta:
-		author = "AlienVault (Alberto Ortega)"
-		description = "TheMask / Careto SGH component signature"
-		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
-		date = "2014/02/11"
-	strings:
-		$m1 = "PGPsdkDriver" ascii wide fullword
-		$m2 = "jpeg1x32" ascii wide fullword
-		$m3 = "SkypeIE6Plugin" ascii wide fullword
-		$m4 = "CDllUninstall" ascii wide fullword
-	condition:
-		2 of them
+rule Careto_SGH 
+{
+
+    meta:
+        author = "AlienVault (Alberto Ortega)"
+        description = "TheMask / Careto SGH component signature"
+        reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+        date = "2014/02/11"
+
+    strings:
+        $m1 = "PGPsdkDriver" ascii wide fullword
+        $m2 = "jpeg1x32" ascii wide fullword
+        $m3 = "SkypeIE6Plugin" ascii wide fullword
+        $m4 = "CDllUninstall" ascii wide fullword
+
+    condition:
+        2 of them
 }
 
-rule Careto_OSX_SBD : APT Careto {
-	meta:
-		author = "AlienVault (Alberto Ortega)"
-		description = "TheMask / Careto OSX component signature"
-		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
-		date = "2014/02/11"
-	strings:
-		/* XORed "/dev/null strdup() setuid(geteuid())" */
-		$1 = {FF 16 64 0A 7E 1A 63 4D 21 4D 3E 1E 60 0F 7C 1A 65 0F 74 0B 3E 1C 7F 12}
-	condition:
-		all of them
+rule Careto_OSX_SBD 
+{
+
+    meta:
+        author = "AlienVault (Alberto Ortega)"
+        description = "TheMask / Careto OSX component signature"
+        reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+        date = "2014/02/11"
+
+    strings:
+        /* XORed "/dev/null strdup() setuid(geteuid())" */
+        $1 = {FF 16 64 0A 7E 1A 63 4D 21 4D 3E 1E 60 0F 7C 1A 65 0F 74 0B 3E 1C 7F 12}
+
+    condition:
+        all of them
 }
 
-rule Careto_CnC : APT Careto {
-	meta:
-		author = "AlienVault (Alberto Ortega)"
-		description = "TheMask / Careto CnC communication signature"
-		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
-		date = "2014/02/11"
-	strings:
-		$1 = "cgi-bin/commcgi.cgi" ascii wide
-		$2 = "Group" ascii wide
-		$3 = "Install" ascii wide
-		$4 = "Bn" ascii wide
-	condition:
-		all of them
+rule Careto_CnC 
+{
+
+    meta:
+        author = "AlienVault (Alberto Ortega)"
+        description = "TheMask / Careto CnC communication signature"
+        reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+        date = "2014/02/11"
+
+    strings:
+        $1 = "cgi-bin/commcgi.cgi" ascii wide
+        $2 = "Group" ascii wide
+        $3 = "Install" ascii wide
+        $4 = "Bn" ascii wide
+
+    condition:
+        all of them
 }
 
-rule Careto_CnC_domains : APT Careto {
-	meta:
-		author = "AlienVault (Alberto Ortega)"
-		description = "TheMask / Careto known command and control domains"
-		reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
-		date = "2014/02/11"
-	strings:
-		$1 = "linkconf.net" ascii wide nocase
-		$2 = "redirserver.net" ascii wide nocase
-		$3 = "swupdt.com" ascii wide nocase
-	condition:
-		any of them
+rule Careto_CnC_domains 
+{
+
+    meta:
+        author = "AlienVault (Alberto Ortega)"
+        description = "TheMask / Careto known command and control domains"
+        reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
+        date = "2014/02/11"
+
+    strings:
+        $1 = "linkconf.net" ascii wide nocase
+        $2 = "redirserver.net" ascii wide nocase
+        $3 = "swupdt.com" ascii wide nocase
+
+    condition:
+        any of them
 }