Update PoisonIvy.yar

malware/PoisonIvy.yar

@@ -5,7 +5,7 @@
 
 import "pe"
 
-rule poisonivy : rat
+rule poisonivy_1 : rat
 {
 	meta:
 		description = "Poison Ivy"
@@ -51,7 +51,26 @@ rule PoisonIvy_Generic_3 {
 				$k1 or all of ($s*) or all of ($h*)
 			)
 }
-rule PoisonIvy
+rule PoisonIvy_2
+{
+	meta:
+		author = " Kevin Breen <kevin@techanarchy.net>"
+		date = "2014/04"
+		ref = "http://malwareconfig.com/stats/PoisonIvy"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+
+    strings:
+    	$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
+        $string1 = "CONNECT %s:%i HTTP/1.0"
+        $string2 = "ws2_32"
+        $string3 = "cks=u"
+        $string4 = "thj@h"
+        $string5 = "advpack"
+    condition:
+		$stub at 0x1620 and all of ($string*) or (all of them)
+}
+rule PoisonIvy_3
 {
 	meta:
 		author = " Kevin Breen <kevin@techanarchy.net>"