nuclei-templates/file/malware/warp-malware.yaml

26 lines
512 B
YAML

id: warp-malware
info:
name: Warp Malware - Detect
author: daffainfo
severity: info
reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Warp.yar
tags: malware,file
file:
- extensions:
- all
matchers-condition: or
matchers:
- type: word
part: raw
words:
- "/2011/n325423.shtml?"
- "wyle"
- "\\~ISUN32.EXE"
condition: or
- type: binary
binary:
- "80382B7503C6002D80382F7503C6005F"