From d767fcc5b9de6d56f4872cbe83ea85bbee2e15bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Rivero=20L=C3=B3pez?= <mriverolopez@gmail.com>
Date: Tue, 24 Jan 2017 14:46:26 +0100
Subject: [PATCH] Update MALW_DirtJumper.yar

---
 malware/MALW_DirtJumper.yar | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/malware/MALW_DirtJumper.yar b/malware/MALW_DirtJumper.yar
index f2ebbf8..7ed4dd6 100644
--- a/malware/MALW_DirtJumper.yar
+++ b/malware/MALW_DirtJumper.yar
@@ -5,11 +5,13 @@
 
 rule DirtJumper_drive
 {
+   
     meta:
         author = "Jason Jones <jasonjones@arbor.net>"
         date = "2013-08-26"
         description = "Identify first version of drive DDoS malware"
         source = "https://github.com/arbor/yara/blob/master/drive.yara"
+   
     strings:
         $cmd1 = "-get" fullword
         $cmd2 = "-ip" fullword
@@ -24,6 +26,7 @@ rule DirtJumper_drive
         $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
         $newver1 = "-icmp"
         $newver2 = "<xmp>"
+   
     condition:
         4 of ($cmd*) and all of ($str*) and not any of ($newver*)
 }
@@ -31,11 +34,13 @@ rule DirtJumper_drive
 
 rule DirtJumper_drive2
 {
+   
     meta:
         author = "Jason Jones <jasonjones@arbor.net>"
         date = "2013-08-26"
         description = "Identify newer version of drive DDoS malware"
         source = "https://github.com/arbor/yara/blob/master/drive2.yara"
+   
     strings:
         $cmd1 = "-get" fullword
         $cmd2 = "-ip" fullword
@@ -52,6 +57,7 @@ rule DirtJumper_drive2
         $newver2 = "-byte"
         $newver3 = "-long"
         $newver4 = "<xmp>"
+  
     condition:
         4 of ($cmd*) and all of ($str*) and all of ($newver*)
 }
@@ -59,11 +65,13 @@ rule DirtJumper_drive2
 
 rule DirtJumper_drive3
 {
+  
     meta:
         author = "Jason Jones <jasonjones@arbor.net>"
         date = "2014-03-17"
         description = "Identify version of Drive DDoS malware using compromised sites"
         source = "https://github.com/arbor/yara/blob/master/drive3.yara"
+  
     strings:
         $cmd1 = "-get" fullword
         $cmd2 = "-ip" fullword
@@ -80,6 +88,7 @@ rule DirtJumper_drive3
         $newver2 = "-byte"
         $newver3 = "-long"
         $drive3 = "99=1"
+  
     condition:
         4 of ($cmd*) and all of ($str*) and all of ($newver*) and $drive3
 }