Update general_cloaking.yar

malware/general_cloaking.yar

@@ -15,50 +15,6 @@
 
 */
 
-rule EXE_cloaked_as_TXT {
-	meta:
-		description = "Executable with TXT extension"
-		author = "Florian Roth"
-	condition:
-		uint16(0) == 0x5a4d 					// Executable
-		and filename matches /\.txt$/is   // TXT extension (case insensitive)
-}
-
-rule EXE_extension_cloaking {
-	meta:
-		description = "Executable showing different extension (Windows default 'hide known extension')"
-		author = "Florian Roth"
-	condition:
-		filename matches /\.txt\.exe$/is or	// Special file extensions
-		filename matches /\.pdf\.exe$/is		// Special file extensions
-}
-
-rule Cloaked_RAR_File {
-	meta:
-		description = "RAR file cloaked by a different extension"
-		author = "Florian Roth"
-	condition:
-		uint32be(0) == 0x52617221							// RAR File Magic Header
-		and not filename matches /(rarnew.dat|\.rar)$/is	// not the .RAR extension
-		and not filepath contains "Recycle" 				// not a deleted RAR file in recycler
-}
-
-rule Base64_encoded_Executable {
-	meta:
-		description = "Detects an base64 encoded executable (often embedded)"
-		author = "Florian Roth"
-		date = "2015-05-28"
-		score = 40
-	strings:
-		$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" // 14 samples in goodware archive
-		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" // 26 samples in goodware archive
-		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" // 75 samples in goodware archive
-		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" // 168 samples in goodware archive
-		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" // 28,529 samples in goodware archive
-	condition:
-		1 of them and not filepath contains "Thunderbird"
-}
-
 rule Binary_Drop_Certutil {
 	meta:
 		description = "Drop binary as base64 encoded cert trick"