Skip to content

R
rules
Commit 3c5c319b by mmorenog Committed by GitHub
Options

Update MiniAsp3_mem.yar

parent 80b91c21
Showing with 1 additions and 1 deletions
malware/MiniAsp3_mem.yar
...@@ -2,7 +2,7 @@ rule MiniAsp3_mem { ...@@ -2,7 +2,7 @@ rule MiniAsp3_mem {
meta: author = "chort (@chort0)" meta: author = "chort (@chort0)"
description = "Detect MiniASP3 in memory" description = "Detect MiniASP3 in memory"
strings: strings:
$pdb = "MiniAsp3/\Release/\MiniAsp.pdb" fullword $pdb = "MiniAsp3/\Release/\MiniAsp\.pdb" fullword
$httpAbout = "http://%s/about.htm" fullword $httpAbout = "http://%s/about.htm" fullword
$httpResult = "http://%s/result_%s.htm" fullword $httpResult = "http://%s/result_%s.htm" fullword
$msgInetFail = "open internet failed…" fullword $msgInetFail = "open internet failed…" fullword
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment