Commit 5f94e04a by Yara Rules

Modify meta of gholee rules

parent ffd79059
...@@ -8,21 +8,27 @@ import "pe" ...@@ -8,21 +8,27 @@ import "pe"
rule gholeeV1 rule gholeeV1
{ {
meta: meta:
description = "Gholee first discovered variant " Author = "@GelosSnake"
author = "@GelosSnake" Date = "2014/08"
date = "2014/08" Description = "Gholee first discovered variant "
Reference = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html"
strings: strings:
$a = "sandbox_avg10_vc9_SP1_2011" $a = "sandbox_avg10_vc9_SP1_2011"
$b = "gholee" $b = "gholee"
condition: condition:
all of them all of them
} }
rule gholeeV2 rule gholeeV2
{ {
meta: meta:
author = "@GelosSnake" Author = "@GelosSnake"
date = "2015-02-12" Date = "2015-02-12"
Description = "Gholee first discovered variant "
Reference = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html"
strings: strings:
$string0 = "RichHa" $string0 = "RichHa"
$string1 = " ((((( H" wide $string1 = " ((((( H" wide
...@@ -42,6 +48,7 @@ rule gholeeV2 ...@@ -42,6 +48,7 @@ rule gholeeV2
$string16 = "77A779" $string16 = "77A779"
$string17 = "<C<G<M<R<X<" $string17 = "<C<G<M<R<X<"
$string18 = "9 9-9N9X9s9" $string18 = "9 9-9N9X9s9"
condition: condition:
18 of them 18 of them
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment