Commit 2b474ade by Antonio Sánchez Committed by GitHub

Merge pull request #263 from mikesxrs/patch-7

Create MALW_adwind_RAT.yar
parents 5190a2ea 95c41189
rule Adwind
{
meta:
author="Asaf Aprozper, asafa AT minerva-labs.com"
description = "Adwind RAT"
reference = "https://minerva-labs.com/post/adwind-and-other-evasive-java-rats"
last_modified = "2017-06-25"
strings:
$a0 = "META-INF/MANIFEST.MF"
$a1 = /Main(\$)Q[0-9][0-9][0-9][0-9]/
$PK = "PK"
condition:
$PK at 0 and $a0 and $a1
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment