Update IndiaBravo.yara

2551753b · mmorenog · 641023d9 · 2551753b
Commit 2551753b authored Feb 25, 2016 by mmorenog
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 19 deletions

IndiaBravo.yara malware/Operation_Blockbuster/IndiaBravo.yara +1 -19

No files found.
--- a/malware/Operation_Blockbuster/IndiaBravo.yara
+++ b/malware/Operation_Blockbuster/IndiaBravo.yara
@@ -69,25 +69,7 @@ rule IndiaBravo_RomeoBravo
 		FF 15 6C E7 40 00  call    CloseHandle_9
 	*/
-	$a = {
+	$a = {E8 [4] 68 [2] 00 00 68 [4] A3 [4]	89 15 [4] E8 [4] 83 C4 08 8D [3] 6A 00 5? 68 [2] 00 00 	68 [4] 5? FF 15 [4] 5? 	FF 15}
-			E8 [4] 
-			68 [2] 00 00 
-			68 [4]
-			A3 [4]
-			89 15 [4]
-			E8 [4]
-			83 C4 08 
-			8D [3]
-			6A 00 
-			5? 
-			68 [2] 00 00 
-			68 [4]
-			5? 
-			FF 15 [4]
-			5? 
-			FF 15 
-		}
 		$b1 = "tmscompg.msi" wide
 		$b2 = "cvrit000.bat"