Update APT_PCclient.yar

malware/APT_PCclient.yar

@@ -5,23 +5,26 @@
 
 import "pe"
 
-rule backdoor_apt_pcclient : Backdoor Dropper
+rule backdoor_apt_pcclient
 {
-meta:
-	author = "@patrickrolsen"
-	maltype = "APT.PCCLient"
-	filetype = "DLL"
-	version = "0.1"
-	description = "Detects the dropper: 869fa4dfdbabfabe87d334f85ddda234 AKA dw20.dll/msacm32.drv dropped by 4a85af37de44daf5917f545c6fd03902 (RTF)"
-	date = "2012-10"
-strings:
-	$magic = { 4d 5a } // MZ
-	$string1 = "www.micro1.zyns.com"
-	$string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
-	$string3 = "msacm32.drv" wide
-	$string4 = "C:\\Windows\\Explorer.exe" wide
-	$string5 = "Elevation:Administrator!" wide
-	$string6 = "C:\\Users\\cmd\\Desktop\\msacm32\\Release\\msacm32.pdb"
-condition:
-	$magic at 0 and 4 of ($string*)
+
+    meta:
+        author = "@patrickrolsen"
+        maltype = "APT.PCCLient"
+        filetype = "DLL"
+        version = "0.1"
+        description = "Detects the dropper: 869fa4dfdbabfabe87d334f85ddda234 AKA dw20.dll/msacm32.drv dropped by 4a85af37de44daf5917f545c6fd03902 (RTF)"
+        date = "2012-10"
+
+    strings:
+        $magic = { 4d 5a } // MZ
+        $string1 = "www.micro1.zyns.com"
+        $string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
+        $string3 = "msacm32.drv" wide
+        $string4 = "C:\\Windows\\Explorer.exe" wide
+        $string5 = "Elevation:Administrator!" wide
+        $string6 = "C:\\Users\\cmd\\Desktop\\msacm32\\Release\\msacm32.pdb"
+
+    condition:
+        $magic at 0 and 4 of ($string*)
 }