Move is__elf to MISC_Utils.yar

1ad69954 · jovimon · GitHub · 8fcbb5e5 · 1ad69954
Unverified Commit 1ad69954 authored 6 years ago by jovimon Committed by GitHub 6 years ago
Show whitespace changes
Inline Side-by-side

Showing with 0 additions and 12 deletions

MALW_Mirai_Okiru_ELF.yar malware/MALW_Mirai_Okiru_ELF.yar +0 -12

No files found.
--- a/malware/MALW_Mirai_Okiru_ELF.yar
+++ b/malware/MALW_Mirai_Okiru_ELF.yar
@@ -24,18 +24,6 @@ private rule is__Mirai_gen7 {
        	5 of them
 }
-private rule is__elf {
-	meta:
-		author = "@mmorenog,@yararules"
-	strings:
-		$header = { 7F 45 4C 46 }
-	condition:
-		$header at 0
-}
 rule Mirai_Okiru {
 	meta:
 		description = "Detects Mirai Okiru MALW"