Skip to content

R
rules
Commit 8579a7ee by @Antelox Committed by GitHub
Options

Update RANSOM_Petya.yar

parent 79314fcb
Showing with 3 additions and 3 deletions
malware/RANSOM_Petya.yar
...@@ -37,9 +37,9 @@ meta: ...@@ -37,9 +37,9 @@ meta:
author = "CCN-CERT" author = "CCN-CERT"
version = "1.0" version = "1.0"
strings: strings:
$ = { C1 C8 14 2B F0 03 F0 2B F0 03 F0 C1 C0 14 03 C2 } $a1 = { C1 C8 14 2B F0 03 F0 2B F0 03 F0 C1 C0 14 03 C2 }
$ = { 46 F7 D8 81 EA 5A 93 F0 12 F7 DF C1 CB 10 81 F6 } $a2 = { 46 F7 D8 81 EA 5A 93 F0 12 F7 DF C1 CB 10 81 F6 }
$ = { 0C 88 B9 07 87 C6 C1 C3 01 03 C5 48 81 C3 A3 01 00 00 } $a3 = { 0C 88 B9 07 87 C6 C1 C3 01 03 C5 48 81 C3 A3 01 00 00 }
condition: condition:
all of them all of them
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment