Delete Backdoor_WinntiPharma.yar

a4286ff4 · mmorenog · GitHub · 6ddd80c7 · 6ddd80c7
Commit a4286ff4 authored Jul 20, 2016 by mmorenog Committed by GitHub Jul 20, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 0 additions and 18 deletions

Backdoor_WinntiPharma.yar malware/Backdoor_WinntiPharma.yar +0 -18

No files found.
--- a/malware/Backdoor_WinntiPharma.yar
+++ b/malware/Backdoor_WinntiPharma.yar
-rule WinntiPharma
-{
-meta:
-	author = "Jose Ramon Palanco"
-	copyright = "Drainware, Inc."
-	date = "2015-06-23"
-	description = "Backdoor Win64 Winnti Pharma"
-	ref = "https://securelist.com/blog/research/70991/games-are-over/"
-
-strings:
-	$s0 = "Cookie: SN="
-	$s1 = "{3ec05b4a-ea88-1378-3389-66706ba27600}"
-	$s2 = "{4D36E972-E325-11CE-BFC1-08002BE10318}"
-	$s3 = "master secret"
-	$s4 = "MyEngineNetEvent"
-condition:
-	all of ($s*)
-}