diff --git a/yara/virus/Linux.Virus.Vit.yara b/yara/virus/Linux.Virus.Vit.yara index eb31c5d..8bd68e1 100644 --- a/yara/virus/Linux.Virus.Vit.yara +++ b/yara/virus/Linux.Virus.Vit.yara @@ -1,5 +1,3 @@ -import "elf" - rule Linux_Virus_Vit : tc_detection malicious { meta: @@ -32,5 +30,5 @@ rule Linux_Virus_Vit : tc_detection malicious $vit_str = "vi324.tmp" condition: - uint32(0) == 0x464C457F and $vit_entry_point at elf.entry_point and $vit_str -} \ No newline at end of file + uint32(0) == 0x464C457F and all of them +}