From 09f57261dab568a1a6dbf2dec093638db0ebef8f Mon Sep 17 00:00:00 2001
From: mmorenog <mmorenog@users.noreply.github.com>
Date: Thu, 26 Nov 2015 09:50:27 +0100
Subject: [PATCH] Update PoisonIvy.yar

---
 malware/PoisonIvy.yar | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/malware/PoisonIvy.yar b/malware/PoisonIvy.yar
index 95ad736..d9e1144 100644
--- a/malware/PoisonIvy.yar
+++ b/malware/PoisonIvy.yar
@@ -70,22 +70,3 @@ rule PoisonIvy_2
     condition:
 		$stub at 0x1620 and all of ($string*) or (all of them)
 }
-rule PoisonIvy_3
-{
-	meta:
-		author = " Kevin Breen <kevin@techanarchy.net>"
-		date = "2014/04"
-		ref = "http://malwareconfig.com/stats/PoisonIvy"
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
-
-    strings:
-    	$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
-        $string1 = "CONNECT %s:%i HTTP/1.0"
-        $string2 = "ws2_32"
-        $string3 = "cks=u"
-        $string4 = "thj@h"
-        $string5 = "advpack"
-    condition:
-		$stub at 0x1620 and all of ($string*) or (all of them)
-}