Skip to content

R
rules
Commit e37d6a5d by mmorenog Committed by GitHub
Options

Update and rename APT_Sofacy_jun16.yar to APT_Sofacy_Jun16.yar

parent 4730d03e
Showing with 3 additions and 3 deletions
malware/APT_Sofacy_jun16.yar → malware/APT_Sofacy_Jun16.yar
......@@ -7,7 +7,7 @@
/* Rule Set ----------------------------------------------------------------- */
rule Sofacy_Jun16_Sample1 {
rule Sofacy_Jun16_Sample1 : Sofacy APT APT28 {
meta:
description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
author = "Florian Roth"
......@@ -22,7 +22,7 @@ rule Sofacy_Jun16_Sample1 {
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )
}
rule Sofacy_Jun16_Sample2 {
rule Sofacy_Jun16_Sample2 : Sofacy APT APT28 {
meta:
description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
author = "Florian Roth"
......@@ -44,7 +44,7 @@ rule Sofacy_Jun16_Sample2 {
( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )
}
rule Sofacy_Jun16_Sample3 {
rule Sofacy_Jun16_Sample3 : Sofacy APT APT28 {
meta:
description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
author = "Florian Roth"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment