Update and rename Casper.yar to APT_Casper.yar

malware/Casper.yar → malware/APT_Casper.yar

@@ -5,7 +5,7 @@
 
 import "pe"
 
-rule Casper_Backdoor_x86 {
+rule Casper_Backdoor_x86 : APT Backdoor {
 	meta:
 		description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
 		author = "Florian Roth"
@@ -36,7 +36,7 @@ rule Casper_Backdoor_x86 {
 		( 3 of ($x*) and 2 of ($y*) and 2 of ($z*) )
 }
 
-rule Casper_EXE_Dropper {
+rule Casper_EXE_Dropper : Dropper {
 	meta:
 		description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
 		author = "Florian Roth"