add goleee rules

http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html

malware.yar

@@ -5,6 +5,47 @@
 
 import "pe"
 
+rule gholeeV1
+{
+    meta:
+    	 description = "Gholee first discovered variant "
+	 author = "@GelosSnake"
+    	 date = "2014/08"
+    strings:
+    	 $a = "sandbox_avg10_vc9_SP1_2011"
+    	$b = "gholee"
+    condition:
+    all of them
+}
+
+rule gholeeV2
+{
+   meta:
+	author = "@GelosSnake"
+	date = "2015-02-12"
+   strings:
+	$string0 = "RichHa"
+	$string1 = "         (((((                  H" wide
+	$string2 = "1$1,141<1D1L1T1\\1d1l1t1"
+	$string3 = "<8;$O' "
+	$string4 = "@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]"
+	$string5 = "jYPQTVTSkllZTTXRTUiHceWda/"
+	$string6 = "urn:schemas-microsoft-com:asm.v1"
+	$string7 = "8.848H8O8i8s8y8"
+	$string8 = "wrapper3" wide
+	$string9 = "pwwwwwwww"
+	$string10 = "Sunday"
+	$string11 = "YYuTVWh"
+	$string12 = "DDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDIN"
+	$string13 = "ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt"
+	$string15 = "wrapper3 Version 1.0" wide
+	$string16 = "77A779"
+	$string17 = "<C<G<M<R<X<"
+	$string18 = "9 9-9N9X9s9"
+    condition:
+	18 of them
+}
+
 rule GlassesCode : Glasses Family 
 {
     meta: