Skip to content

R
rules
Commit 04c8297f by mmorenog Committed by GitHub
Options

Update APT_Carbanak.yar

parent 37cd8e2e
Showing with 3 additions and 3 deletions
malware/APT_Carbanak.yar
......@@ -11,7 +11,7 @@
/* Rule Set ----------------------------------------------------------------- */
rule Carbanak_0915_1 {
rule Carbanak_0915_1 : APT {
meta:
description = "Carbanak Malware"
author = "Florian Roth"
......@@ -25,7 +25,7 @@ rule Carbanak_0915_1 {
uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
}
rule Carbanak_0915_2 {
rule Carbanak_0915_2 : APT {
meta:
description = "Carbanak Malware"
author = "Florian Roth"
......@@ -46,7 +46,7 @@ rule Carbanak_0915_2 {
uint16(0) == 0x5a4d and filesize < 500KB and ( $x1 or all of ($s*) )
}
rule Carbanak_0915_3 {
rule Carbanak_0915_3 : APT {
meta:
description = "Carbanak Malware"
author = "Florian Roth"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment