Commit f65206e4 by mmorenog

Update Adwind_JAR_PACKB.yar

parent 328677f0
......@@ -4,14 +4,14 @@
*/
rule Adwind_JAR_PACKB {
meta:
author = “Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com”
author = "Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com"
reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf"
last_modi ed = “2015-11-30”
last_modi ed = "2015-11-30"
strings:
$c1 = “META-INF/MANIFEST.MF” ascii
$c2 = “main/Start.class” ascii
$a1 = “con g/con g.perl” ascii
$b1 = “java/textito.isn” ascii
$c1 = "META-INF/MANIFEST.MF" ascii
$c2 = "main/Start.class" ascii
$a1 = "con g/con g.perl" ascii
$b1 = "java/textito.isn" ascii
condition:
int16(0) == 0x4B50 and ($c1 and $c2 and ($a1 or $b1))
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment