Sneed-Reactivity/yara-mikesxrs/malc0de/webc2_bolid_apt1.yar

10 lines
235 B
Text
Raw Permalink Normal View History

rule webc2_bolid : apt
{
strings:
$a = ".htmlEEEEEEEEEEEEEEEEEEEEEEEEEEEEsleep:"
$b = "downloadcopy:"
$c = "geturl:"
$d = "Q3JlYXRlUHJvY2Vzc0E="
condition:
filesize < 100KB and (4 of ($a,$b,$c,$d))
}