/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.

*/

rule TreasureHunt
  {
    meta:
      author = "Minerva Labs"
      ref ="http://www.minerva-labs.com/#!Cybercriminals-Adopt-the-Mossad-Emblem/c7a5/573da2d60cf2f90ca6f6e3ed"
      date = "2016/06"
      maltype = "Point of Sale (POS) Malware"
      filetype = "exe"

    strings:
      $a = "treasureHunter.pdb"
      $b = "jucheck"
      $c = "cmdLineDecrypted"

    condition:
      all of them
}