Create MALW_TrickBot.yar

malware/MALW_TrickBot.yar

@@ -6,8 +6,7 @@ rule MALW_trickbot_bankBot : Trojan
 {
 meta:
  author = "Marc Salinas @Bondey_m"
- description = "Detects Trickbot Banking
-Trojan"
+ description = "Detects Trickbot Banking Trojan"
 strings:
 $str_trick_01 = "moduleconfig"
 $str_trick_02 = "Start"
@@ -22,8 +21,7 @@ Trojan
 {
 meta:
 author = "Marc Salinas @Bondey_m"
-description = "Detects systeminfo
-module from Trickbot Trojan"
+description = "Detects systeminfo module from Trickbot Trojan"
 strings:
 $str_systeminf_01 = "<program>"
 $str_systeminf_02 = "<service>"
@@ -39,8 +37,7 @@ rule MALW_dllinject_trickbot_module : Trojan
 {
 meta:
 author = "Marc Salinas @Bondey_m"
-description = " Detects dllinject module
-from Trickbot Trojan"
+description = " Detects dllinject module from Trickbot Trojan"
 strings:
 $str_dllinj_01 = "user_pref("
 $str_dllinj_02 = "<ignore_mask>"
@@ -54,8 +51,7 @@ Trojan
 {
 meta:
 author = "Marc Salinas @Bondey_m"
-description = " Detects mailsearcher
-module from Trickbot Trojan"
+description = " Detects mailsearcher module from Trickbot Trojan"
 strings:
 $str_mails_01 = "mailsearcher"
 $str_mails_02 = "handler"