Skip to content

R
rules
Commit 222b5df6 by mmorenog
Options

Update and rename RomeoGolf.yara to RomeoGolf_mod.yara

parent e184ac38
Showing with 5 additions and 0 deletions
malware/Operation_Blockbuster/RomeoGolf.yara → malware/Operation_Blockbuster/RomeoGolf_mod.yara
// This rule has been modified by @mmorenog
// Original->$idGen = {FF 15 [4] 50 E8 [4] 83 C4 04 E8 [4] C1 ?? 10 89 [2] E8 [4] 01 [2] E8 [4] C1 ?? 10 89 [2] E8 [4]}
// Final -> $idGen = {FF 15 [4] 50 E8 [4] 83 C4 04 E8 [4] C1 ?? 10 89 [2] E8 [4] 01 [2] E8 [4] C1 ?? 10 89 [2] E8 [4] ?? ?? ?? }
import "pe" import "pe"
rule RomeoGolf rule RomeoGolf
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment