Update Ransom_DMALocker.yar

malware/Ransom_DMALocker.yar

@@ -3,6 +3,7 @@ rule DMALocker
 {
     meta:
     Description = "Deteccion del ransomware DMA Locker desde la version 1.0 a la 4.0"
+    ref = "https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/"
     Author = "SadFud"
     Date = "30/05/2016"
     
@@ -16,3 +17,21 @@ rule DMALocker
     any of them
     
 }
+
+//More at reversecodes.wordpress.com
+rule DMALocker4.0
+{
+    meta:
+    Description = "Deteccion del ransomware DMA Locker version 4.0"
+    ref = "https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/"
+    Author = "SadFud"
+    Date = "30/05/2016"
+	Hash = "e3106005a0c026fc969b46c83ce9aeaee720df1bb17794768c6c9615f083d5d1"
+    
+    strings:
+    $clave = { 21 44 4d 41 4c 4f 43 4b 34 2e 30 }
+    
+    condition:
+    $clave 
+    
+}