Create APT_APT15.yar

Create RANSOM_SamSam.yar

Create APT_EnergeticBear_backdoored_ssh.yar

Create MALW_Kwampirs.yar

MInor spelling and grammar changges

Create RANSOM_GPGQwerty.yar

add new rule for Sigma ransomware

from https://securelist.com/energetic-bear-crouching-yeti/85345/

https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia

Minor adjustments to improve comprehensibility.

Adding all rules from https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity

from https://securingtomorrow.mcafee.com/mcafee-labs/ransomware-takes-open-source-path-encrypts-gnu-privacy-guard/

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/

new rule for Shifu/Shis malware

Create APT_DPRK_ROKRAT.yar

Rules from https://www.carbonblack.com/2018/02/27/threat-analysis-rokrat-malware/

Create Android_Tempting_Cedar_Spyware.yar

see reference for hashes

Create MALW_Monero_Miner_installer.yar

Update RANSOM_MS17-010_Wannacrypt.yar

Update RANSOM_Petya_MS17_010

Create Android_Polish_Bankbot.yar

Add Turla neuron2 from NCSC report

Create CVE-2018-4878.yar

https://www.cert.pl/en/news/single/analysis-of-a-polish-bankbot/

adding rule from https://blueliv.com/petya-ransomware-cyber-attack-is-spreading-across-the-globe-part-2/

rules from https://blueliv.com/wannacrypt-malware-analysis/

https://www.alienvault.com/blogs/labs-research/a-north-korean-monero-cryptocurrency-miner