Update PoisonIvy.yar

malware/PoisonIvy.yar

@@ -51,3 +51,22 @@ rule PoisonIvy_Generic_3 {
 				$k1 or all of ($s*) or all of ($h*)
 			)
 }
+rule PoisonIvy
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/PoisonIvy"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+    strings:
+    	$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
+        $string1 = "CONNECT %s:%i HTTP/1.0"
+        $string2 = "ws2_32"
+        $string3 = "cks=u"
+        $string4 = "thj@h"
+        $string5 = "advpack"
+    condition:
+		$stub at 0x1620 and all of ($string*) or (all of them)
+}