Sneed-Reactivity/yara-mikesxrs/malc0de/glooxmail_apt1.yar

10 lines
184 B
Text
Raw Permalink Normal View History

rule glooxmail : apt
{
strings:
$a = "This is gloox"
$b = "Getfile Abrot!"
$c = "glooxtest"
condition:
filesize < 100KB and (3 of ($a,$b,$c))
}