Update APT_Careto.yar

Fixed rule style

malware/APT_Careto.yar

@@ -4,59 +4,75 @@
 
 import "pe"
 
-rule Careto_SGH : APT Careto  {
+rule Careto_SGH 
+{
+
     meta:
         author = "AlienVault (Alberto Ortega)"
         description = "TheMask / Careto SGH component signature"
         reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
         date = "2014/02/11"
+
     strings:
         $m1 = "PGPsdkDriver" ascii wide fullword
         $m2 = "jpeg1x32" ascii wide fullword
         $m3 = "SkypeIE6Plugin" ascii wide fullword
         $m4 = "CDllUninstall" ascii wide fullword
+
     condition:
         2 of them
 }
 
-rule Careto_OSX_SBD : APT Careto {
+rule Careto_OSX_SBD 
+{
+
     meta:
         author = "AlienVault (Alberto Ortega)"
         description = "TheMask / Careto OSX component signature"
         reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
         date = "2014/02/11"
+
     strings:
         /* XORed "/dev/null strdup() setuid(geteuid())" */
         $1 = {FF 16 64 0A 7E 1A 63 4D 21 4D 3E 1E 60 0F 7C 1A 65 0F 74 0B 3E 1C 7F 12}
+
     condition:
         all of them
 }
 
-rule Careto_CnC : APT Careto {
+rule Careto_CnC 
+{
+
     meta:
         author = "AlienVault (Alberto Ortega)"
         description = "TheMask / Careto CnC communication signature"
         reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
         date = "2014/02/11"
+
     strings:
         $1 = "cgi-bin/commcgi.cgi" ascii wide
         $2 = "Group" ascii wide
         $3 = "Install" ascii wide
         $4 = "Bn" ascii wide
+
     condition:
         all of them
 }
 
-rule Careto_CnC_domains : APT Careto {
+rule Careto_CnC_domains 
+{
+
     meta:
         author = "AlienVault (Alberto Ortega)"
         description = "TheMask / Careto known command and control domains"
         reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
         date = "2014/02/11"
+
     strings:
         $1 = "linkconf.net" ascii wide nocase
         $2 = "redirserver.net" ascii wide nocase
         $3 = "swupdt.com" ascii wide nocase
+
     condition:
         any of them
 }