diff --git a/malware/PoisonIvy.yar b/malware/PoisonIvy.yar index 95ad736..d9e1144 100644 --- a/malware/PoisonIvy.yar +++ b/malware/PoisonIvy.yar @@ -70,22 +70,3 @@ rule PoisonIvy_2 condition: $stub at 0x1620 and all of ($string*) or (all of them) } -rule PoisonIvy_3 -{ - meta: - author = " Kevin Breen " - date = "2014/04" - ref = "http://malwareconfig.com/stats/PoisonIvy" - maltype = "Remote Access Trojan" - filetype = "exe" - - strings: - $stub = {04 08 00 53 74 75 62 50 61 74 68 18 04} - $string1 = "CONNECT %s:%i HTTP/1.0" - $string2 = "ws2_32" - $string3 = "cks=u" - $string4 = "thj@h" - $string5 = "advpack" - condition: - $stub at 0x1620 and all of ($string*) or (all of them) -}