Move is__elf to MISC_Utils.yar

1ad69954 · jovimon · GitHub · 8fcbb5e5 · 1ad69954
Unverified Commit 1ad69954 authored Jun 02, 2018 by jovimon Committed by GitHub Jun 02, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 0 additions and 12 deletions

MALW_Mirai_Okiru_ELF.yar malware/MALW_Mirai_Okiru_ELF.yar +0 -12

No files found.
--- a/malware/MALW_Mirai_Okiru_ELF.yar
+++ b/malware/MALW_Mirai_Okiru_ELF.yar
@@ -24,18 +24,6 @@ private rule is__Mirai_gen7 {
        	5 of them
 }

-private rule is__elf {
-
-	meta:
-		author = "@mmorenog,@yararules"
-		
-	strings:
-		$header = { 7F 45 4C 46 }
-
-	condition:
-		$header at 0
-}
-
 rule Mirai_Okiru {
 	meta:
 		description = "Detects Mirai Okiru MALW"