Skip to content

R
rules
Commit 29d900f4 by Marc Rivero López Committed by GitHub
Options

Update APT_APT9002.yar 

Fixed rule style
parent 6364ad80
Showing with 8 additions and 4 deletions
malware/APT_APT9002.yar
...@@ -5,8 +5,9 @@ ...@@ -5,8 +5,9 @@
import "pe" import "pe"
rule APT9002Code : APT9002 Family rule APT9002Code
{ {
meta: meta:
description = "9002 code features" description = "9002 code features"
author = "Seth Hardy" author = "Seth Hardy"
...@@ -22,8 +23,9 @@ rule APT9002Code : APT9002 Family ...@@ -22,8 +23,9 @@ rule APT9002Code : APT9002 Family
any of them any of them
} }
rule APT9002Strings : APT9002 Family rule APT9002Strings
{ {
meta: meta:
description = "9002 Identifying Strings" description = "9002 Identifying Strings"
author = "Seth Hardy" author = "Seth Hardy"
...@@ -42,8 +44,9 @@ rule APT9002Strings : APT9002 Family ...@@ -42,8 +44,9 @@ rule APT9002Strings : APT9002 Family
any of them any of them
} }
rule APT9002 : Family rule APT9002
{ {
meta: meta:
description = "9002" description = "9002"
author = "Seth Hardy" author = "Seth Hardy"
...@@ -53,8 +56,9 @@ rule APT9002 : Family ...@@ -53,8 +56,9 @@ rule APT9002 : Family
APT9002Code or APT9002Strings APT9002Code or APT9002Strings
} }
rule FE_APT_9002 : RAT rule FE_APT_9002
{ {
meta: meta:
Author = "FireEye Labs" Author = "FireEye Labs"
Date = "2013/11/10" Date = "2013/11/10"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment