Update APT_Poseidon_Group.yar

malware/APT_Poseidon_Group.yar

@@ -10,7 +10,9 @@
 	Identifier: Poseidon Group APT
 */
 
-rule PoseidonGroup_Malware {
+rule PoseidonGroup_Malware 
+{
+
     meta:
         description = "Detects Poseidon Group Malware"
         author = "Florian Roth"
@@ -24,6 +26,7 @@ rule PoseidonGroup_Malware {
         hash5 = "d090b1d77e91848b1e2f5690b54360bbbd7ef808d017304389b90a0f8423367f"
         hash6 = "d7c8b47a0d0a9181fb993f17e165d75a6be8cf11812d3baf7cf11d085e21d4fb"
         hash7 = "ded0ee29af97496f27d810f6c16d78a3031d8c2193d5d2a87355f3e3ca58f9b3"
+
     strings:
         $s1 = "c:\\winnt\\system32\\cmd.exe" fullword ascii
         $s2 = "c:\\windows\\system32\\cmd.exe" fullword ascii
@@ -36,7 +39,6 @@ rule PoseidonGroup_Malware {
         $s9 = "Server 2012" fullword ascii /* Goodware String - occured 1 times */
         $s10 = "Server 2008" fullword ascii /* Goodware String - occured 1 times */
         $s11 = "Server 2003" fullword ascii /* Goodware String - occured 1 times */
-
         $a1 = "net.exe group \"Domain Admins\" /domain" fullword ascii
         $a2 = "net.exe group \"Admins. do Dom" fullword ascii
         $a3 = "(SVRID=%d)" fullword ascii
@@ -44,12 +46,15 @@ rule PoseidonGroup_Malware {
         $a5 = "(SVR=%s)" fullword ascii
         $a6 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
         $a7 = "net.exe localgroup Administradores" fullword ascii
+
     condition:
         ( uint16(0) == 0x5a4d and filesize < 650KB and 6 of ($s*) ) or
         ( 4 of ($s*) and 1 of ($a*) )
 }
 
-rule PoseidonGroup_MalDoc_1 {
+rule PoseidonGroup_MalDoc_1 
+{
+
     meta:
         description = "Detects Poseidon Group - Malicious Word Document"
         author = "Florian Roth"
@@ -57,13 +62,17 @@ rule PoseidonGroup_MalDoc_1 {
         date = "2016-02-09"
         score = 80
         hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
+
     strings:
         $s1 = "c:\\cmd32dll.exe" fullword ascii
+
     condition:
         uint16(0) == 0xcfd0 and filesize < 500KB and all of them
 }
 
-rule PoseidonGroup_MalDoc_2 {
+rule PoseidonGroup_MalDoc_2 
+{
+
     meta:
         description = "Detects Poseidon Group - Malicious Word Document"
         author = "Florian Roth"
@@ -76,12 +85,14 @@ rule PoseidonGroup_MalDoc_2 {
         hash4 = "ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed"
         hash5 = "27449198542fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778"
         hash6 = "1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216"
+
     strings:
         $s0 = "{\\*\\generator Msftedit 5.41." ascii
         $s1 = "Attachment 1: Complete Professional Background" ascii
         $s2 = "E-mail:  \\cf1\\ul\\f1"
         $s3 = "Education:\\par" ascii
         $s5 = "@gmail.com" ascii
+
     condition:
         uint32(0) == 0x74725c7b and filesize < 500KB and 3 of them
 }