Added DarkComet_Keylogger_File from Loki thor-hacktools.yar

malware/DarkComet.yar

@@ -58,4 +58,18 @@ rule DarkComet : rat
 		any of them
 }
 
-
+rule DarkComet_Keylogger_File
+{
+	meta:
+		author = "Florian Roth"
+		description = "Looks like a keylogger file created by DarkComet Malware"
+		date = "25.07.14"
+		reference = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
+		score = 50
+	strings:
+		$magic = "::"
+		$entry = /\n:: [A-Z]/
+		$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
+	condition:
+		($magic at 0) and #entry > 10 and #timestamp > 10
+}