Update CRIME_Shifu_trojan.yar

malware/CRIME_Shifu_trojan.yar

 /*
     This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
 */
-/*
-	Yara Rule Set
-	Author: Florian Roth
-	Date: 2015-09-01
-	Identifier: Shifu
-*/
-
 rule Shifu_Banking_Trojan {
 	meta:
 		description = "Detects Shifu Banking Trojan"
@@ -60,3 +53,16 @@ rule SHIFU_Banking_Trojan {
 	condition:
 		uint16(0) == 0x5a4d and ($x1 or 5 of ($s*))
 }
+rule Shifu : Shifu {
+	meta:
+		reference = "https://blogs.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/"
+		author = "McAfee Labs"
+	strings:
+		$a = “CryptCreateHash”
+		$b = “RegCreateKeyA”
+		$c = {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 25 00 73 00 00 00 00 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 00 00 72 00 75 00 6E}
+		$d = {53 00 6E 00 64 00 56 00 6F 00 6C 00 2E 00 65 00 78 00 65}
+		$e = {52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 45 00 58 00 45}
+	condition:
+		all of them
+}