Update IndiaWhiskey.yara

721ad18a · mmorenog · 0e0ae573 · 721ad18a
Commit 721ad18a authored Feb 25, 2016 by mmorenog
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 20 deletions

IndiaWhiskey.yara malware/Operation_Blockbuster/IndiaWhiskey.yara +1 -20

No files found.
--- a/malware/Operation_Blockbuster/IndiaWhiskey.yara
+++ b/malware/Operation_Blockbuster/IndiaWhiskey.yara
@@ -39,26 +39,7 @@ rule IndiaWhiskey
 		FF 15 E4 49 40 00  call    CreateServiceA
 	*/
-	$a = {
+	$a = {FF 15 [4] 83 C4 18 8D [5] 5? 5? 5? 5? 5? 5? 6A 01	[0-2] 6A 02 68 20 01 00 00 68 FF 01 0F 00 FF 75 ?? FF 75 ?? (5? | FF 75 ??) FF 15}
-			FF 15 [4] 
-			83 C4 18 
-			8D [5] 
-			5? 
-			5? 
-			5? 
-			5? 
-			5? 
-			5? 
-			6A 01
-			[0-2] 
-			6A 02 
-			68 20 01 00 00 
-			68 FF 01 0F 00 
-			FF 75 ?? 
-			FF 75 ?? 
-			(5? | FF 75 ??)
-			FF 15 
-		}
 	condition:
 		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))