From dd80771f052ab878edfef3de3c87bf8a6e2fadcf Mon Sep 17 00:00:00 2001
From: mmorenog <mmorenog@users.noreply.github.com>
Date: Wed, 20 Jul 2016 13:31:27 +0200
Subject: [PATCH] Update and rename Casper.yar to APT_Casper.yar

---
 malware/{Casper.yar => APT_Casper.yar} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename malware/{Casper.yar => APT_Casper.yar} (97%)

diff --git a/malware/Casper.yar b/malware/APT_Casper.yar
similarity index 97%
rename from malware/Casper.yar
rename to malware/APT_Casper.yar
index 5a0e9f0..3257ba6 100644
--- a/malware/Casper.yar
+++ b/malware/APT_Casper.yar
@@ -5,7 +5,7 @@
 
 import "pe"
 
-rule Casper_Backdoor_x86 {
+rule Casper_Backdoor_x86 : APT Backdoor {
 	meta:
 		description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
 		author = "Florian Roth"
@@ -36,7 +36,7 @@ rule Casper_Backdoor_x86 {
 		( 3 of ($x*) and 2 of ($y*) and 2 of ($z*) )
 }
 
-rule Casper_EXE_Dropper {
+rule Casper_EXE_Dropper : Dropper {
 	meta:
 		description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
 		author = "Florian Roth"