admin/Yara-Rules-rules
1
0
Fork 0
mirror of https://github.com/Yara-Rules/rules synced 2026-06-08 12:58:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update LimaDelta.yara

Browse Source
This commit is contained in:
mmorenog
2016-02-25 19:19:05 +01:00
parent bba6b142cb
commit 2d10ec7803
1 changed files with 1 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
malware/Operation_Blockbuster/LimaDelta.yara
+1 -15
View File
@@ -39,21 +39,7 @@ rule LimaDelta
83 C3 46 add ebx, 46h
*/
$authenicateBufferGen = {
BB 01
74 ??
FF 15 [4]
99
B? 32 00 00 00
F7 ??
8B ??
8D [3]
5?
5?
E8 [4]
83 C4 08
83 ?? 46
}
$authenicateBufferGen = {BB 01 74 ?? FF 15 [4] 99 B? 32 00 00 00 F7 ?? 8B ?? 8D [3] 5? 5? E8 [4] 83 C4 08 83 ?? 46}
condition:
$authenicateBufferGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))