Commit 7653bdd6 by Yara Rules

Solve problem with last commit

parent e72d310c
...@@ -78,15 +78,10 @@ rule DarkComet_3 ...@@ -78,15 +78,10 @@ rule DarkComet_3
$b3 = "I wasn't able to open the hosts file" $b3 = "I wasn't able to open the hosts file"
$b4 = "#BOT#VisitUrl" $b4 = "#BOT#VisitUrl"
$b5 = "#KCMDDC" $b5 = "#KCMDDC"
<<<<<<< HEAD
condition: condition:
all of ($a*) or all of ($b*) all of ($a*) or all of ($b*)
} }
=======
rule DarkComet_Keylogger_File rule DarkComet_Keylogger_File
{ {
meta: meta:
...@@ -102,4 +97,3 @@ rule DarkComet_Keylogger_File ...@@ -102,4 +97,3 @@ rule DarkComet_Keylogger_File
condition: condition:
($magic at 0) and #entry > 10 and #timestamp > 10 ($magic at 0) and #entry > 10 and #timestamp > 10
} }
>>>>>>> pr/23
...@@ -819,7 +819,7 @@ rule LightFTP_Config { ...@@ -819,7 +819,7 @@ rule LightFTP_Config {
condition: condition:
uint16(0) == 0xfeff and filesize < 1KB and all of them uint16(0) == 0xfeff and filesize < 1KB and all of them
} }
<<<<<<< HEAD
rule SpyGate_v2_9 rule SpyGate_v2_9
{ {
meta: meta:
...@@ -836,6 +836,7 @@ rule SpyGate_v2_9 ...@@ -836,6 +836,7 @@ rule SpyGate_v2_9
condition: condition:
all of them all of them
} }
rule PythoRAT rule PythoRAT
{ {
meta: meta:
...@@ -855,7 +856,10 @@ rule PythoRAT ...@@ -855,7 +856,10 @@ rule PythoRAT
$g = "PluginData" $g = "PluginData"
$i = "OnPluginMessage" $i = "OnPluginMessage"
======= condition:
all of them
}
rule CN_Toolset_sig_1433_135_sqlr { rule CN_Toolset_sig_1433_135_sqlr {
meta: meta:
...@@ -871,12 +875,10 @@ rule CN_Toolset_sig_1433_135_sqlr { ...@@ -871,12 +875,10 @@ rule CN_Toolset_sig_1433_135_sqlr {
$s11 = ";DATABASE=master" fullword ascii $s11 = ";DATABASE=master" fullword ascii
$s12 = "xp_cmdshell '" fullword ascii $s12 = "xp_cmdshell '" fullword ascii
$s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii $s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
>>>>>>> pr/23
condition: condition:
all of them all of them
} }
<<<<<<< HEAD
rule VirusRat rule VirusRat
{ {
meta: meta:
...@@ -903,6 +905,7 @@ rule VirusRat ...@@ -903,6 +905,7 @@ rule VirusRat
condition: condition:
all of them all of them
} }
rule ice_ix_12xy : banker rule ice_ix_12xy : banker
{ {
meta: meta:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment