Sneed-Reactivity/yara-mikesxrs/malc0de/newsreels_apt1.yar

8 lines
184 B
Text
Raw Permalink Normal View History

rule newsreels : apt
{
strings:
$a = "name=%s&userid=%04d&other=%c%s"
$b = "thequickbrownfxjmpsvalzydg"
condition:
filesize < 300KB and (2 of ($a,$b))
}