Merge pull request #244 from Bondey/master

added apt28 downdelph rules

malware/APT_fancybear_downdelph.yar

+rule APT_fancybear_Downdelph_magic : Bootkit{
+	meta:
+		author = "Marc Salinas @Bondey_m"
+		description = "APT28 downdelph magic string"
+		reference = "https://www.threatminer.org/_reports/2016/eset-sednit-part3%20-%20ESET.pdf#viewer.action=download"
+	strings:
+		$str1 = " :3 "
+	condition:
+		$str1 at 0
+}
+
+
+
+rule APT_fancybear_Downdelph_MBR : Bootkit{
+	meta:
+		author = "Marc Salinas @Bondey_m"
+		description = "APT28 downdelph string on MBR (get your MBR with BOOTICE on Win or #dd if=/dev/sda of=./sda.mbr bs=512 count=1"
+		reference = "https://www.threatminer.org/_reports/2016/eset-sednit-part3%20-%20ESET.pdf#viewer.action=download"
+	strings:
+		$s1 = { 20 3A 33 20 } //string " :3 "
+	condition:
+		$s1 at 411  //posición 0x19b
+}
\ No newline at end of file