Update UniformJuliett.yara

b7682be4 · mmorenog · 3a706786 · b7682be4
Commit b7682be4 authored Feb 25, 2016 by mmorenog
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 12 deletions

UniformJuliett.yara malware/Operation_Blockbuster/UniformJuliett.yara +1 -12

No files found.
--- a/malware/Operation_Blockbuster/UniformJuliett.yara
+++ b/malware/Operation_Blockbuster/UniformJuliett.yara
@@ -19,18 +19,7 @@ rule UniformJuliett
 			FF 15 3C 70 40 00  call    ds:DeleteFileA
 		*/
-		$a = {
+		$a = {56 FF D5 68 B8 0B 00 00 FF 15 [4] 6A 00 68 [4] E8 [4] 83 C4 08 68 [4] FF 15}
-				56 
-				FF D5 
-				68 B8 0B 00 00 
-				FF 15 [4] 
-				6A 00 
-				68 [4]
-				E8 [4]
-				83 C4 08 
-				68 [4]
-				FF 15 
-			}
 		$ = "wauserv.dll"
 		$ = "Rpcss"