Merge pull request #117 from bartblaze/patch-1

Create FastPOS

malware/FastPOS

+rule PoS_Malware_fastpos : FastPOS
+{
+meta:
+author = "Trend Micro, Inc."
+date = "2016-05-18"
+description = "Used to detect FastPOS keyloggger + scraper"
+sample_filetype = "exe"
+strings:
+$string1 = "uniqyeidclaxemain"
+$string2 = "http://%s/cdosys.php"
+$string3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
+$string4 = "\\The Hook\\Release\\The Hook.pdb" nocase
+condition:
+all of ($string*)
+}