Update MALW_Cloaking.yar

malware/MALW_Cloaking.yar

@@ -15,31 +15,39 @@
 
 */
 
-rule Binary_Drop_Certutil : binary {
-	meta:
-		description = "Drop binary as base64 encoded cert trick"
-		author = "Florian Roth"
-		reference = "https://goo.gl/9DNn8q"
-		date = "2015-07-15"
-		score = 70
-	strings:
-		$s0 = "echo -----BEGIN CERTIFICATE----- >" ascii
-		$s1 = "echo -----END CERTIFICATE----- >>" ascii
-		$s2 = "certutil -decode " ascii
-	condition:
-		filesize < 10KB and all of them
+rule Binary_Drop_Certutil
+{
+
+    meta:
+        description = "Drop binary as base64 encoded cert trick"
+        author = "Florian Roth"
+        reference = "https://goo.gl/9DNn8q"
+        date = "2015-07-15"
+        score = 70
+
+    strings:
+        $s0 = "echo -----BEGIN CERTIFICATE----- >" ascii
+        $s1 = "echo -----END CERTIFICATE----- >>" ascii
+        $s2 = "certutil -decode " ascii
+  
+    condition:
+        filesize < 10KB and all of them
 }
 
-rule StegoKatz {
-	meta:
-		description = "Encoded Mimikatz in other file types"
-		author = "Florian Roth"
-		reference = "https://goo.gl/jWPBBY"
-		date = "2015-09-11"
-		score = 70
-	strings:
-		$s1 = "VC92Ny9TSXZMNk5jLy8vOUlqUTFVRlFNQTZMLysvdjlJaTh2L0ZUNXJBUUJJaTFRa1NFaUx6K2hWSS8vL1NJME44bklCQU9pZC92Ny9USTJjSkpBQUFBQXp3RW1MV3hCSmkyc1lTWXR6S0VtTDQxL0R6TXhNaTl4SmlWc0lUWWxMSUUySlF4aFZWbGRCVkVGVlFWWkJWMGlCN1BBQUFBQklnMlFrYUFDNE1BQUFBRW1MNkVTTmNPQ0pSQ1JnaVVRa1pFbU5RN0JKaTlsTWpRWFBGQU1BU0ls" ascii
-		$s2 = "Rpd3ovN3FlalVtNklLQ0xNNGtOV1BiY0VOVHROT0Zud25CWGN0WS9BcEdMR28rK01OWm85Nm9xMlNnY1U5aTgrSTBvNkFob1FOTzRHQWdtUElEVmlqald0Tk90b2FmN01ESWJUQkF5T0pYbTB4bFVHRTBZWEFWOXVoNHBkQnRrS0VFWWVBSEE2TDFzU0c5a2ZFTEc3QWd4WTBYY1l3ZzB6QUFXS09JZE9wQVhEK3lnS3lsR3B5Q1ljR1NJdFNseGZKWUlVVkNFdEZPVjRJUldERUl1QXpKZ2pCQWdsd0Va" ascii
-	condition:
-		filesize < 1000KB and 1 of them
+rule StegoKatz 
+{
+
+    meta:
+        description = "Encoded Mimikatz in other file types"
+        author = "Florian Roth"
+        reference = "https://goo.gl/jWPBBY"
+        date = "2015-09-11"
+        score = 70
+
+    strings:
+        $s1 = "VC92Ny9TSXZMNk5jLy8vOUlqUTFVRlFNQTZMLysvdjlJaTh2L0ZUNXJBUUJJaTFRa1NFaUx6K2hWSS8vL1NJME44bklCQU9pZC92Ny9USTJjSkpBQUFBQXp3RW1MV3hCSmkyc1lTWXR6S0VtTDQxL0R6TXhNaTl4SmlWc0lUWWxMSUUySlF4aFZWbGRCVkVGVlFWWkJWMGlCN1BBQUFBQklnMlFrYUFDNE1BQUFBRW1MNkVTTmNPQ0pSQ1JnaVVRa1pFbU5RN0JKaTlsTWpRWFBGQU1BU0ls" ascii
+        $s2 = "Rpd3ovN3FlalVtNklLQ0xNNGtOV1BiY0VOVHROT0Zud25CWGN0WS9BcEdMR28rK01OWm85Nm9xMlNnY1U5aTgrSTBvNkFob1FOTzRHQWdtUElEVmlqald0Tk90b2FmN01ESWJUQkF5T0pYbTB4bFVHRTBZWEFWOXVoNHBkQnRrS0VFWWVBSEE2TDFzU0c5a2ZFTEc3QWd4WTBYY1l3ZzB6QUFXS09JZE9wQVhEK3lnS3lsR3B5Q1ljR1NJdFNseGZKWUlVVkNFdEZPVjRJUldERUl1QXpKZ2pCQWdsd0Va" ascii
+   
+    condition:
+        filesize < 1000KB and 1 of them
 }