Skip to content

R
rules
Commit 1453de57 by Xumeiquer
Options

Fixing rulenames in malware/APT_Grasshopper.yar

parent d9c8783f
Showing with 4 additions and 2 deletions
malware/APT_Grasshopper.yar
...@@ -7,6 +7,8 @@ Author: Jaume Martin ...@@ -7,6 +7,8 @@ Author: Jaume Martin
Date: 07-04-2017 Date: 07-04-2017
*/ */
import "hash"
rule Control32 { rule Control32 {
meta: meta:
author = "Jaume Martin" author = "Jaume Martin"
...@@ -35,7 +37,7 @@ rule GH_PM64 { ...@@ -35,7 +37,7 @@ rule GH_PM64 {
hash.md5(0, filesize) == "fe6c0097412b2c7b7f4b8a489004dd14" hash.md5(0, filesize) == "fe6c0097412b2c7b7f4b8a489004dd14"
} }
rule MemStub32-GH1 { rule MemStub32_GH1 {
meta: meta:
author = "Jaume Martin" author = "Jaume Martin"
condition: condition:
...@@ -49,7 +51,7 @@ rule MemStub32 { ...@@ -49,7 +51,7 @@ rule MemStub32 {
hash.md5(0, filesize) == "8987652f26732607b769247adb4e9cce" hash.md5(0, filesize) == "8987652f26732607b769247adb4e9cce"
} }
rule MemStub64-GH1 { rule MemStub64_GH1 {
meta: meta:
author = "Jaume Martin" author = "Jaume Martin"
condition: condition:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment