Sneed-Reactivity/yara-mikesxrs/alienvault/ccrewSSLBack2.yar

rule ccrewSSLBack2
{
    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"

  strings:
    $a = {39 82 49 42 BE 1F 3A}

  condition:
    any of them
}