Update APT_Prikormka.yar

malware/APT_Prikormka.yar

@@ -30,15 +30,15 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 //
 
-private rule PrikormkaDropper
+rule PrikormkaDropper
 {
     strings:
         $mz = { 4D 5A }
 
-        $kd1 = "KDSTORAGE" wide
-        $kd1 = "KDSTORAGE_64" wide
-        $kd1 = "KDRUNDRV32" wide
-        $kd1 = "KDRAR" wide
+        $kd = "KDSTORAGE" wide
+        $kd = "KDSTORAGE_64" wide
+        $kd = "KDRUNDRV32" wide
+        $kd = "KDRAR" wide
 
         $bin = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
         $bin = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
@@ -50,7 +50,7 @@ private rule PrikormkaDropper
         ($mz at 0) and ((any of ($bin)) or (3 of ($kd1)) or (all of ($inj)))
 }
 
-private rule PrikormkaModule
+rule PrikormkaModule
 {
     strings:
         $mz = { 4D 5A }
@@ -109,7 +109,7 @@ private rule PrikormkaModule
         ($mz at 0) and (any of ($str))
 }
 
-private rule PrikormkaEarlyVersion
+rule PrikormkaEarlyVersion
 {
     strings:
         $mz = { 4D 5A }