Commit 5f94e04a by Yara Rules

Modify meta of gholee rules

parent ffd79059
......@@ -8,21 +8,27 @@ import "pe"
rule gholeeV1
{
meta:
description = "Gholee first discovered variant "
author = "@GelosSnake"
date = "2014/08"
Author = "@GelosSnake"
Date = "2014/08"
Description = "Gholee first discovered variant "
Reference = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html"
strings:
$a = "sandbox_avg10_vc9_SP1_2011"
$b = "gholee"
$b = "gholee"
condition:
all of them
all of them
}
rule gholeeV2
{
meta:
author = "@GelosSnake"
date = "2015-02-12"
Author = "@GelosSnake"
Date = "2015-02-12"
Description = "Gholee first discovered variant "
Reference = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html"
strings:
$string0 = "RichHa"
$string1 = " ((((( H" wide
......@@ -42,6 +48,7 @@ rule gholeeV2
$string16 = "77A779"
$string17 = "<C<G<M<R<X<"
$string18 = "9 9-9N9X9s9"
condition:
18 of them
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment