Skip to content

R
rules
Commit edc73485 by mmorenog Committed by GitHub
Options

Update APT_Careto.yar

parent 04c8297f
Showing with 4 additions and 4 deletions
malware/APT_Careto.yar
...@@ -4,7 +4,7 @@ ...@@ -4,7 +4,7 @@
import "pe" import "pe"
rule Careto_SGH { rule Careto_SGH : APT Careto {
meta: meta:
author = "AlienVault (Alberto Ortega)" author = "AlienVault (Alberto Ortega)"
description = "TheMask / Careto SGH component signature" description = "TheMask / Careto SGH component signature"
...@@ -19,7 +19,7 @@ rule Careto_SGH { ...@@ -19,7 +19,7 @@ rule Careto_SGH {
2 of them 2 of them
} }
rule Careto_OSX_SBD { rule Careto_OSX_SBD : APT Careto {
meta: meta:
author = "AlienVault (Alberto Ortega)" author = "AlienVault (Alberto Ortega)"
description = "TheMask / Careto OSX component signature" description = "TheMask / Careto OSX component signature"
...@@ -32,7 +32,7 @@ rule Careto_OSX_SBD { ...@@ -32,7 +32,7 @@ rule Careto_OSX_SBD {
all of them all of them
} }
rule Careto_CnC { rule Careto_CnC : APT Careto {
meta: meta:
author = "AlienVault (Alberto Ortega)" author = "AlienVault (Alberto Ortega)"
description = "TheMask / Careto CnC communication signature" description = "TheMask / Careto CnC communication signature"
...@@ -47,7 +47,7 @@ rule Careto_CnC { ...@@ -47,7 +47,7 @@ rule Careto_CnC {
all of them all of them
} }
rule Careto_CnC_domains { rule Careto_CnC_domains : APT Careto {
meta: meta:
author = "AlienVault (Alberto Ortega)" author = "AlienVault (Alberto Ortega)"
description = "TheMask / Careto known command and control domains" description = "TheMask / Careto known command and control domains"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment