Skip to content

R
rules
Commit 8d546691 by mmorenog
Options

Update RomeoFoxtrot.yara

parent f6fedd46
Showing with 1 additions and 1 deletions
malware/Operation_Blockbuster/RomeoFoxtrot.yara
...@@ -45,7 +45,7 @@ rule RomeoFoxtrot ...@@ -45,7 +45,7 @@ rule RomeoFoxtrot
FF D7 call edi ; setsockopt <--- this could be a relative call in some variants FF D7 call edi ; setsockopt <--- this could be a relative call in some variants
*/ */
$connect = {C7 [3] 01 00 00 00 8B [6] C7 [3] 00 00 20 03 5? 89 [3] (FF 15 [4] | E8 [4]) 6A 06 6A 01 6A 02 66 [4] 66 [4] 02 00 (15 [4] | E8 [4]) 83 F8 FF 89 [2] 0F 84 [4] [0-7] 8D [3] 6A 04 5? 68 02 10 00 00 68 FF FF 00 00 5? (FF D? | E8 [4]) 8B [2] 8D [3] 6A 04 5? 68 01 10 00 00 68 FF FF 00 00 5? (FF D? | E8 [4])} $connect = {C7 [3] 01 00 00 00 8B [6] C7 [3] 00 00 20 03 5? 89 [3] (FF 15 [4] | E8 [4]) 6A 06 6A 01 6A 02 66 [4] 66 [4] 02 00 (FF 15 [4] | E8 [4]) 83 F8 FF 89 [2] 0F 84 [4] [0-7] 8D [3] 6A 04 5? 68 02 10 00 00 68 FF FF 00 00 5? (FF D? | E8 [4]) 8B [2] 8D [3] 6A 04 5? 68 01 10 00 00 68 FF FF 00 00 5? (FF D? | E8 [4])}
$response = "RESPONSE 200 OK!!!" $response = "RESPONSE 200 OK!!!"
condition: condition:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment