Update RomeoHotel.yara

55c09c7d · mmorenog · f14a60f2 · 55c09c7d
Commit 55c09c7d authored Feb 25, 2016 by mmorenog
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 10 deletions

RomeoHotel.yara malware/Operation_Blockbuster/RomeoHotel.yara +1 -10

No files found.
--- a/malware/Operation_Blockbuster/RomeoHotel.yara
+++ b/malware/Operation_Blockbuster/RomeoHotel.yara
@@ -40,16 +40,7 @@ rule RomeoHotel
 		E8 4C 7C 00 00        call    __allmul
 	*/
-	$diskSpace = {FF 15 [4]
+	$diskSpace = {FF 15 [4] 85 C0 74 ?? 8B [6] 6A 00 99 68 00 00 10 00 5? 5? E8}
-			85 C0 
-			74 ??
-			8B [6]
-			6A 00 
-			99 
-			68 00 00 10 00 
-			5? 
-			5? 
-			E8}
 	$winst = "winsta0\\default" wide		// this limits the overlap with RomeoGolf