Commit 7653bdd6 by Yara Rules

Solve problem with last commit

parent e72d310c
......@@ -78,15 +78,10 @@ rule DarkComet_3
$b3 = "I wasn't able to open the hosts file"
$b4 = "#BOT#VisitUrl"
$b5 = "#KCMDDC"
<<<<<<< HEAD
condition:
all of ($a*) or all of ($b*)
}
=======
rule DarkComet_Keylogger_File
{
meta:
......@@ -102,4 +97,3 @@ rule DarkComet_Keylogger_File
condition:
($magic at 0) and #entry > 10 and #timestamp > 10
}
>>>>>>> pr/23
......@@ -819,7 +819,7 @@ rule LightFTP_Config {
condition:
uint16(0) == 0xfeff and filesize < 1KB and all of them
}
<<<<<<< HEAD
rule SpyGate_v2_9
{
meta:
......@@ -836,6 +836,7 @@ rule SpyGate_v2_9
condition:
all of them
}
rule PythoRAT
{
meta:
......@@ -855,7 +856,10 @@ rule PythoRAT
$g = "PluginData"
$i = "OnPluginMessage"
=======
condition:
all of them
}
rule CN_Toolset_sig_1433_135_sqlr {
meta:
......@@ -871,12 +875,10 @@ rule CN_Toolset_sig_1433_135_sqlr {
$s11 = ";DATABASE=master" fullword ascii
$s12 = "xp_cmdshell '" fullword ascii
$s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
>>>>>>> pr/23
condition:
all of them
}
<<<<<<< HEAD
rule VirusRat
{
meta:
......@@ -903,6 +905,7 @@ rule VirusRat
condition:
all of them
}
rule ice_ix_12xy : banker
{
meta:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment