Update IndiaJuliett.yara

malware/Operation_Blockbuster/IndiaJuliett.yara

@@ -48,21 +48,7 @@ rule IndiaJuliett
 			81 C6 00 28 00 00  add     esi, 2800h
 		*/
 	
-		$writeFile = {
-				68 00 28 00 00 
-				5? 
-				E8 [4-7] 
-				8D [3] 
-				6A 00 
-				5? 
-				68 00 28 00 00 
-				5? 
-				5? 
-				FF 15 [4] 
-				81 ?? 00 28 00 00 
-				81 ?? 00 28 00 00 
-				81 ?? 00 28 00 00 
-			}
+		$writeFile = {68 00 28 00 00 5?	E8 [4-7] 8D [3] 6A 00 5? 68 00 28 00 00 5? 5? FF 15 [4] 81 ?? 00 28 00 00 81 ?? 00 28 00 00 81 ?? 00 28 00 00}
 				
 	condition:
 		($configFilename in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size)) or