Update RomeoFoxtrot_mod.yara.error

Webshells/WShell_Drupalgeddon2_icos.yar has been added in order to de…

Add MALW_FUDCrypt.yar and MALW_MSILStealer.yar

Create RANSOM_Maze.yar

Add Chacha stream cipher constants for 128-bit and 256-bit key

Update WhiskeyBravo_mod.yara

Add SHA2 / BLAKE2 / Argon2 IVs

fix RomeoFoxtrot YARA > 3.3.0 hex issue

see https://github.com/VirusTotal/yara/issues/911#issuecomment-404324560

will propagate to https://github.com/Yara-Rules/rules/pull/348

41badf10ef6f469dd1c3be201aba809f9c42f86ad77d7f83bc3895bfa289c635 is WhiskeyDelta

Actualizar regla FIN7 -> Cobalt

Actualizar Index de malware FIN7 -> Cobalt

Webshells_index.yar has been modified in order to add Webshells/WShell_Drupalgeddon2_icos.yar rules.

Webshells/WShell_Drupalgeddon2_icos.yar has been added in order to detect *.ico webshells from Drupalgeddon2 vuln. An attack's write up can be found here https://rankinstudio.com/Drupal_ico_index_hack.

New rules for 2 malware families MedussaHTTP bot and AlMashreq agent.

sync my repo with the reference base yara-rules

Syntax error fixed

The $challenge is not defined. Recommend to remove it so that this rule could be imported.

Fix suspicious_packer_section rule

1. The check of first two bytes was wrong for PE files.
2. Limit the search to the first 1024 bytes of the files, which
   should be sufficient to match on section names.