Commit 8cadff08 by mmorenog

Update Equation.yar

parent 45330297
...@@ -579,15 +579,3 @@ rule apt_equation_keyword { ...@@ -579,15 +579,3 @@ rule apt_equation_keyword {
condition: condition:
uint16(0) == 0x5a4d and 1 of ($a*) uint16(0) == 0x5a4d and 1 of ($a*)
} }
rule apt_equation_keyword {
meta:
description = "Rule to detect Equation group's keyword in executable file"
last_modified = "2015-09-26"
reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
strings:
$a1 = "Backsnarf_AB25" wide
$a2 = "Backsnarf_AB25" ascii
condition:
uint16(0) == 0x5a4d and 1 of ($a*)
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment