Skip to content

R
rules
Commit 74aaa299 by mmorenog
Options

Update WhiskeyBravo.yara

parent 8d546691
Showing with 1 additions and 1 deletions
malware/Operation_Blockbuster/WhiskeyBravo.yara
......@@ -38,7 +38,7 @@ rule WhiskeyBravo
FF D7 call edi ; _wcsnicmp
*/
$a = {68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 [4] [0-2] 68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 [4] [0-2] 68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 }
$a = {68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 [4] [0-2] 68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84[4] [0-2] 68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 }
$ext1 = ".wpd" wide nocase
$ext2 = ".doc" wide nocase
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment