Move is__elf to MISC_Utils.yar

9e613bc0 · jovimon · GitHub · 975d251f · 9e613bc0
Unverified Commit 9e613bc0 authored Jun 02, 2018 by jovimon Committed by GitHub Jun 02, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 0 additions and 9 deletions

MALW_Rebirth_Vulcan_ELF.yar malware/MALW_Rebirth_Vulcan_ELF.yar +0 -9

No files found.
--- a/malware/MALW_Rebirth_Vulcan_ELF.yar
+++ b/malware/MALW_Rebirth_Vulcan_ELF.yar
@@ -59,15 +59,6 @@ private rule is__bot_Rebirth_gen3 {
        	6 of them
 }

-private rule is__elf {
-	meta:
-		author = "@mmorenog,@yararules"
-	strings:
-		$header = { 7F 45 4C 46 }
-	condition:
-		$header at 0
-}
-
 rule MALW_Rebirth_Vulcan_ELF {
 	meta:
 		description = "Detects Rebirth Vulcan variant a torlus NextGen MALW"