Skip to content

R
rules
Commit d426ce8e by @Antelox Committed by GitHub
Options

Fixed some errors

parent 153a6771
Showing with 9 additions and 9 deletions
malware/RANSOM_Locky.yar
...@@ -27,16 +27,16 @@ rule Locky_Ransomware : ransom { ...@@ -27,16 +27,16 @@ rule Locky_Ransomware : ransom {
rule Locky_Ransomware_2: ransom { rule Locky_Ransomware_2: ransom {
meta: meta:
description = "Regla para detectar RANSOM.LOCKY" description = "Regla para detectar RANSOM.LOCKY"
author = “CCN-CERT” author = "CCN-CERT"
version = "1.0" version = "1.0"
strings strings:
$ = { 2E 00 6C 00 6F 00 63 00 6B 00 79 00 00 } $a1 = { 2E 00 6C 00 6F 00 63 00 6B 00 79 00 00 }
$ = { 00 5F 00 4C 00 6F 00 63 00 6B 00 79 00 } $a2 = { 00 5F 00 4C 00 6F 00 63 00 6B 00 79 00 }
$ = { 5F 00 72 00 65 00 63 00 6F 00 76 00 65 } $a3 = { 5F 00 72 00 65 00 63 00 6F 00 76 00 65 }
$ = { 00 72 00 5F 00 69 00 6E 00 73 00 74 00 } $a4 = { 00 72 00 5F 00 69 00 6E 00 73 00 74 00 }
$ = { 72 00 75 00 63 00 74 00 69 00 6F 00 6E } $a5 = { 72 00 75 00 63 00 74 00 69 00 6F 00 6E }
$ = { 00 73 00 2E 00 74 00 78 00 74 00 00 } $a6 = { 00 73 00 2E 00 74 00 78 00 74 00 00 }
$ = { 53 6F 66 74 77 61 72 65 5C 4C 6F 63 6B 79 00 } $a7 = { 53 6F 66 74 77 61 72 65 5C 4C 6F 63 6B 79 00 }
condition: condition:
all of them all of them
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment