Update APT_LotusBlossom.yar

7a2db79d · Marc Rivero López · GitHub · db73ef22 · 7a2db79d
Commit 7a2db79d authored Jan 22, 2017 by Marc Rivero López Committed by GitHub Jan 22, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 16 additions and 14 deletions

APT_LotusBlossom.yar malware/APT_LotusBlossom.yar +16 -14

No files found.
--- a/malware/APT_LotusBlossom.yar
+++ b/malware/APT_LotusBlossom.yar
 rule EliseLotusBlossom
 {
+
 meta:
-	author = "Jose Ramon Palanco"
-	date = "2015-06-23"
-	description = "Elise Backdoor Trojan"
-	ref = "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"
+    author = "Jose Ramon Palanco"
+    date = "2015-06-23"
+    description = "Elise Backdoor Trojan"
+    ref = "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"

 strings:
-        $magic = { 4d 5a }
-	$s1 = "\",Update" wide
-	$s2 = "LoaderDLL.dll"
-	$s3 = "Kernel32.dll"
-	$s4 = "{5947BACD-63BF-4e73-95D7-0C8A98AB95F2}"
-	$s5 = "\\Network\\" wide
-	$s6 = "0SSSSS"
-	$s7 = "441202100205"
-	$s8 = "0WWWWW"
+    $magic = { 4d 5a }
+    $s1 = "\",Update" wide
+    $s2 = "LoaderDLL.dll"
+    $s3 = "Kernel32.dll"
+    $s4 = "{5947BACD-63BF-4e73-95D7-0C8A98AB95F2}"
+    $s5 = "\\Network\\" wide
+    $s6 = "0SSSSS"
+    $s7 = "441202100205"
+    $s8 = "0WWWWW"
+
 condition:
-	$magic at 0 and all of ($s*)	
+    $magic at 0 and all of ($s*)    
 }