Commit 64deb08a by mmorenog

Update RomeoGolf.yara

parent 334e114a
...@@ -25,21 +25,7 @@ rule RomeoGolf ...@@ -25,21 +25,7 @@ rule RomeoGolf
01 46 08 add [esi+8], eax 01 46 08 add [esi+8], eax
*/ */
$idGen = { $idGen = {FF 15 [4] 50 E8 [4] 83 C4 04 E8 [4] C1 ?? 10 89 [2] E8 [4] 01 [2] E8 [4] C1 ?? 10 89 [2] E8 [4] }
FF 15 [4]
50
E8 [4]
83 C4 04
E8 [4]
C1 ?? 10
89 [2]
E8 [4]
01 [2]
E8 [4]
C1 ?? 10
89 [2]
E8 [4]
}
condition: condition:
$idGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size)) $idGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment