Merge pull request #384 from lcol3117/master

add .yar extensions and fix a typo

Merge pull request #384 from lcol3117/master
add .yar extensions and fix a typo
1e2a195c · Jaume Martin · GitHub · be978081 · 2221a82d · 1e2a195c
Unverified Commit 1e2a195c authored Jul 01, 2020 by Jaume Martin Committed by GitHub Jul 01, 2020
17 changed files
--- a/maldocs/Maldoc_hancitor_dropper
+++ b/maldocs/Maldoc_hancitor_dropper
--- a/malware/APT_MoonlightMaze
+++ b/malware/APT_MoonlightMaze
--- a/malware/APT_RedLeaves
+++ b/malware/APT_RedLeaves
--- a/malware/APT_Sauron
+++ b/malware/APT_Sauron
--- a/malware/APT_Sauron_extras
+++ b/malware/APT_Sauron_extras
--- a/malware/MALW_Eicar
+++ b/malware/MALW_Eicar
--- a/malware/MALW_kirbi_mimikatz
+++ b/malware/MALW_kirbi_mimikatz
--- a/malware/RANSOM_Petya_MS17_010
+++ b/malware/RANSOM_Petya_MS17_010
--- a/malware/RANSOM_Pico
+++ b/malware/RANSOM_Pico
--- a/malware/RANSOM_Shiva
+++ b/malware/RANSOM_Shiva
--- a/malware/RANSOM_acroware
+++ b/malware/RANSOM_acroware
@@ -12,7 +12,7 @@ rule screenlocker_acroware {
      $s2 = "All your Personal Data got encrypted and the decryption key is stored on a hidden" fullword ascii
      $s3 = "alphaoil@mail2tor.com any try of removing this Ransomware will result in an instantly " fullword ascii
      $s4 = "HKEY_CURRENT_USER\\SoftwareE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
-      $s5 = "webserver, after 72 hours thedecryption key will get removed and your personal" fullword ascii
+      $s5 = "webserver, after 72 hours the decryption key will get removed and your personal" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB ) and all of them
--- a/malware/RANSOM_jeff_dev
+++ b/malware/RANSOM_jeff_dev
--- a/malware/RANSOM_locdoor
+++ b/malware/RANSOM_locdoor
--- a/malware/RANSOM_screenlocker_5h311_1nj3c706
+++ b/malware/RANSOM_screenlocker_5h311_1nj3c706
--- a/malware/RANSOM_shrug2
+++ b/malware/RANSOM_shrug2
--- a/malware/RANSOM_termite
+++ b/malware/RANSOM_termite
--- a/malware/RAT_Orcus
+++ b/malware/RAT_Orcus