diff --git a/malware/Operation_Blockbuster/LimaDelta.yara b/malware/Operation_Blockbuster/LimaDelta.yara index d9416e3..0d79d59 100644 --- a/malware/Operation_Blockbuster/LimaDelta.yara +++ b/malware/Operation_Blockbuster/LimaDelta.yara @@ -39,21 +39,7 @@ rule LimaDelta 83 C3 46 add ebx, 46h */ - $authenicateBufferGen = { - BB 01 - 74 ?? - FF 15 [4] - 99 - B? 32 00 00 00 - F7 ?? - 8B ?? - 8D [3] - 5? - 5? - E8 [4] - 83 C4 08 - 83 ?? 46 - } + $authenicateBufferGen = {BB 01 74 ?? FF 15 [4] 99 B? 32 00 00 00 F7 ?? 8B ?? 8D [3] 5? 5? E8 [4] 83 C4 08 83 ?? 46} condition: $authenicateBufferGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))