Skip to content

R
rules
Commit 12364bc7 by j0sm1
Options

Added Turla reference 

Added Turla reference
parent 590ed089
Showing with 1 additions and 0 deletions
malware/Turla.yar
...@@ -11,6 +11,7 @@ rule WaterBug_turla_dll ...@@ -11,6 +11,7 @@ rule WaterBug_turla_dll
description = "Symantec Waterbug Attack - Trojan Turla DLL" description = "Symantec Waterbug Attack - Trojan Turla DLL"
author = "Symantec Security Response" author = "Symantec Security Response"
date = "22.01.2015" date = "22.01.2015"
reference = "http://www.symantec.com/connect/blogs/turla-spying-tool-targets-governments-and-diplomats"
strings: strings:
$a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/ $a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment