Update RomeoHotel.yara

fd56b86b · mmorenog · 39f96de1 · fd56b86b
Commit fd56b86b authored Feb 25, 2016 by mmorenog
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 13 deletions

RomeoHotel.yara malware/Operation_Blockbuster/RomeoHotel.yara +1 -13

No files found.
--- a/malware/Operation_Blockbuster/RomeoHotel.yara
+++ b/malware/Operation_Blockbuster/RomeoHotel.yara
@@ -25,19 +25,7 @@ rule RomeoHotel
 		41 83 C4 3C     add     r12d, 3Ch
 	*/

-	$randBuff64 = {	E8 [4]
-			44 [2]
-			44 [2] 
-			B? 1F 85 EB 51 
-			48 [2] 
-			41 [2]
-			C1 ?? 05 
-			8B ?? 
-			C1 ?? 1F 
-			03 ?? 
-			6B ?? 64 
-			44 [2] 
-			41 [2] 3C}
+	$randBuff64 = {E8 [4] 44 [2] 44 [2] B? 1F 85 EB 51 48 [2] 41 [2] C1 ?? 05 8B ?? C1 ?? 1F 03 ??	6B ?? 64 44 [2]	41 [2] 3C}
 		
 	/*
 		FF 15 40 70 01 10     call    ds:GetDiskFreeSpaceExA