Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
rules
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
rules
Commits
7653bdd6
Commit
7653bdd6
authored
9 years ago
by
Yara Rules
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Solve problem with last commit
parent
e72d310c
Show whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
7 additions
and
10 deletions
+7
-10
DarkComet.yar
malware/DarkComet.yar
+0
-6
Miscelanea.yar
malware/Miscelanea.yar
+7
-4
No files found.
malware/DarkComet.yar
View file @
7653bdd6
...
...
@@ -78,15 +78,10 @@ rule DarkComet_3
$b3 = "I wasn't able to open the hosts file"
$b4 = "#BOT#VisitUrl"
$b5 = "#KCMDDC"
<<<<<<< HEAD
condition:
all of ($a*) or all of ($b*)
}
=======
rule DarkComet_Keylogger_File
{
meta:
...
...
@@ -102,4 +97,3 @@ rule DarkComet_Keylogger_File
condition:
($magic at 0) and #entry > 10 and #timestamp > 10
}
>>>>>>> pr/23
This diff is collapsed.
Click to expand it.
malware/Miscelanea.yar
View file @
7653bdd6
...
...
@@ -819,7 +819,7 @@ rule LightFTP_Config {
condition:
uint16(0) == 0xfeff and filesize < 1KB and all of them
}
<<<<<<< HEAD
rule SpyGate_v2_9
{
meta:
...
...
@@ -836,6 +836,7 @@ rule SpyGate_v2_9
condition:
all of them
}
rule PythoRAT
{
meta:
...
...
@@ -855,7 +856,10 @@ rule PythoRAT
$g = "PluginData"
$i = "OnPluginMessage"
=======
condition:
all of them
}
rule CN_Toolset_sig_1433_135_sqlr {
meta:
...
...
@@ -871,12 +875,10 @@ rule CN_Toolset_sig_1433_135_sqlr {
$s11 = ";DATABASE=master" fullword ascii
$s12 = "xp_cmdshell '" fullword ascii
$s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
>>>>>>> pr/23
condition:
all of them
}
<<<<<<< HEAD
rule VirusRat
{
meta:
...
...
@@ -903,6 +905,7 @@ rule VirusRat
condition:
all of them
}
rule ice_ix_12xy : banker
{
meta:
...
...
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment