mirror of
https://github.com/reversinglabs/reversinglabs-yara-rules
synced 2026-06-08 17:57:13 +00:00
refactor: avoid using the elf module for performance reasons
This commit is contained in:
@@ -1,5 +1,3 @@
|
||||
import "elf"
|
||||
|
||||
rule Linux_Virus_Vit : tc_detection malicious
|
||||
{
|
||||
meta:
|
||||
@@ -32,5 +30,5 @@ rule Linux_Virus_Vit : tc_detection malicious
|
||||
$vit_str = "vi324.tmp"
|
||||
|
||||
condition:
|
||||
uint32(0) == 0x464C457F and $vit_entry_point at elf.entry_point and $vit_str
|
||||
}
|
||||
uint32(0) == 0x464C457F and all of them
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user