admin/Yara-Rules-rules
1
0
Fork 0
mirror of https://github.com/Yara-Rules/rules synced 2026-06-08 12:58:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update IndiaDelta.yara

Browse Source
This commit is contained in:
mmorenog
2016-02-25 19:19:37 +01:00
parent 2d10ec7803
commit 8da4b62ba9
1 changed files with 1 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
malware/Operation_Blockbuster/IndiaDelta.yara
+1 -8
View File
@@ -23,14 +23,7 @@ rule IndiaDelta
FF 15 E0 2D 41 00 call SetFilePointer_0
*/
$a = {
FF 15 [4-12]
3? 78 56 34 12
[0-2]
8? ?? 78 56 34 12
[0-10]
FF 15
}
$a = {FF 15 [4-12] 3? 78 56 34 12 [0-2] 8? ?? 78 56 34 12 [0-10] FF 15}
condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))