emotet Packer update

59a245a7 · Bondey · b94708a5 · 59a245a7
Commit 59a245a7 authored Dec 12, 2017 by Bondey
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 2 deletions

packer.yar Packers/packer.yar +3 -2

No files found.
--- a/Packers/packer.yar
+++ b/Packers/packer.yar
@@ -20,10 +20,11 @@ rule emotet_packer {
 	  reference = "e31028282c38cb13dd4ede7e9c8aa62d45ddae5ebaa0fe3afb3256601dbf5de7"
      date = "2017-12-12"
    strings:
-		$pdb = "123EErrrtools.pdb"
+		$pdb1 = "123EErrrtools.pdb"
+		$pdb2=  "gGEW\\F???/.pdb"

    condition:
-       $pdb
+       $pdb1 or $pdb2
 }

 rule silent_banker : banker