Update THOR_Webshells.yar

malware/THOR_Webshells.yar

@@ -5037,23 +5037,6 @@ rule DarkSecurityTeam_Webshell {
 		1 of them
 }
 
-rule GIFCloaked_Webshell {
-	meta:
-		description = "Looks like a webshell cloaked as GIF"
-		author = "Florian Roth"
-		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
-		score = 50
-	strings:
-		$magic = { 47 49 46 38 } /* GIF8 ... */
-		$s0 = "input type"
-		$s1 = "<%eval request"
-		$s2 = "<%eval(Request.Item["
-		$s3 = "LANGUAGE='VBScript'"
-	condition:
-		( $magic at 0 ) and ( 1 of ($s*) )
-		and not filepath contains "AppData"
-}
-
 rule PHP_Cloaked_Webshell_SuperFetchExec {
 	meta:
 		description = "Looks like a webshell cloaked as GIF - http://goo.gl/xFvioC"