Skip to content

R
rules
Commit 1784eac1 by mmorenog
Options

Update RomeoGolf.yara

parent 2677e37c
Showing with 1 additions and 1 deletions
malware/Operation_Blockbuster/RomeoGolf.yara
......@@ -25,7 +25,7 @@ rule RomeoGolf
01 46 08 add [esi+8], eax
*/
$idGen = {FF 15 [4] 50 E8 [4] 83 C4 04 E8 [4] C1 ?? 10 89 [2] E8 [4] 01 [2] E8 [4] C1 ?? 10 89 [2] E8 [4]}
$idGen = {FF 15 [4] 50 E8 [4] 83 C4 04 E8 [4] C1 ?? 10 89 [2] E8 [4] 01 [2] E8 [4] C1 ?? 10 89 [2] E8 [4] 01 [2] }
condition:
$idGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment