Skip to content

R
rules
Commit 5bb6eb3f by Eric Chin
Options

The carriage return is causing error when scanning files. Made the string one line.

parent 6c9cbcca
Showing with 1 additions and 3 deletions
malware/APT_RedLeaves
......@@ -17,9 +17,7 @@ rule malware_red_leaves_generic {
$ = "\\\\.\\pipe\\NamePipe_MoreWindows" wide
$ = "RedLeavesCMDSimulatorMutex" wide
$ = "(NT %d.%d Build %d)" wide
$ = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0;
SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C;
.NET4.0E)" wide
$ = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" wide
$ = "red_autumnal_leaves_dllmain.dll" wide ascii
$ = "__data" wide
$ = "__serial" wide
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment