admin/Yara-Rules-rules
1
0
Fork 0
mirror of https://github.com/Yara-Rules/rules synced 2026-06-08 12:58:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update LimaAlfa.yara

Browse Source
This commit is contained in:
mmorenog
2016-02-25 19:01:22 +01:00
parent 55c09c7d65
commit 8901cefaee
1 changed files with 1 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
malware/Operation_Blockbuster/LimaAlfa.yara
+1 -12
View File
@@ -22,18 +22,7 @@ rule LimaAlfa
01 28 add [eax], ebp
*/
$a = {
33 C0
66 [2]
8B ??
81 ?? 00 F0 FF FF
81 ?? 00 30 00 00
75 ??
8B [3]
25 FF 0F 00 00
03 C7
01
}
$a = {33 C0 66 [2] 8B ?? 81 ?? 00 F0 FF FF 81 ?? 00 30 00 00 75 ?? 8B [3] 25 FF 0F 00 00 03 C7 01}
condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))