Webshells/WShell_Drupalgeddon2_icos.yar has been added in order to de…

Add MALW_FUDCrypt.yar and MALW_MSILStealer.yar

Create RANSOM_Maze.yar

Add Chacha stream cipher constants for 128-bit and 256-bit key

Update WhiskeyBravo_mod.yara

Add SHA2 / BLAKE2 / Argon2 IVs

41badf10ef6f469dd1c3be201aba809f9c42f86ad77d7f83bc3895bfa289c635 is WhiskeyDelta

Actualizar regla FIN7 -> Cobalt

Actualizar Index de malware FIN7 -> Cobalt

Webshells_index.yar has been modified in order to add Webshells/WShell_Drupalgeddon2_icos.yar rules.

Webshells/WShell_Drupalgeddon2_icos.yar has been added in order to detect *.ico webshells from Drupalgeddon2 vuln. An attack's write up can be found here https://rankinstudio.com/Drupal_ico_index_hack.

New rules for 2 malware families MedussaHTTP bot and AlMashreq agent.

sync my repo with the reference base yara-rules

Syntax error fixed

Fix suspicious_packer_section rule

1. The check of first two bytes was wrong for PE files.
2. Limit the search to the first 1024 bytes of the files, which
   should be sufficient to match on section names.

Create Capabilities ruleset

Update RAT_Xtreme.yar

Create MALW_KeyBase.yar