Update and rename CRIME_Shifu_trojan.yar to MALW_Shifu.yar

malware/CRIME_Shifu_trojan.yar → malware/MALW_Shifu.yar

 /*
     This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
 */
-rule Shifu_Banking_Trojan {
+rule Shifu_Banking_Trojan : banking {
 	meta:
 		description = "Detects Shifu Banking Trojan"
 		author = "Florian Roth"
@@ -20,7 +20,7 @@ rule Shifu_Banking_Trojan {
 		uint16(0) == 0x5a4d and filesize < 1000KB and ($x1 or all of ($s*))
 }
 
-rule SHIFU_Banking_Trojan {
+rule SHIFU_Banking_Trojan : banking {
 	meta:
 		description = "Detects SHIFU Banking Trojan"
 		author = "Florian Roth"
@@ -53,7 +53,7 @@ rule SHIFU_Banking_Trojan {
 	condition:
 		uint16(0) == 0x5a4d and ($x1 or 5 of ($s*))
 }
-rule Shifu : Shifu {
+rule Shifu : Shifu  : banking {
 	meta:
 		reference = "https://blogs.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/"
 		author = "McAfee Labs"