Merge pull request Yara-Rules#423 from RandomRhythm/patch-1

Tighten Glasses rule
k0ko380 · Nov 18, 2021 · 1d7293e · 1d7293e
2 parents b4126f1 + 12c21f7
commit 1d7293e
Showing 1 changed file with 12 additions and 5 deletions.
diff --git a/malware/MALW_Glasses.yar b/malware/MALW_Glasses.yar
@@ -5,12 +5,15 @@
 
 import "pe"
 
-rule GlassesCode : Glasses Family 
+private rule GlassesCode : Glasses Family 
 {
     meta:
         description = "Glasses code features"
         author = "Seth Hardy"
-        last_modified = "2014-07-22"
+        last_modified = "2021-11-18"
+        reference_file = "aaf262fde1738dbf0bb50213a9624cd6705ebcaeb06c5fcaf7e9f33695d3fc33"
+        reference_url = "https://citizenlab.ca/2013/02/apt1s-glasses-watching-a-human-rights-organization/"
+
 
     strings:
         $ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 }
@@ -25,7 +28,9 @@ rule GlassesStrings : Glasses Family
     meta:
         description = "Strings used by Glasses"
         author = "Seth Hardy"
-        last_modified = "2014-07-22"
+        last_modified = "2021-11-18"
+        reference_file = "aaf262fde1738dbf0bb50213a9624cd6705ebcaeb06c5fcaf7e9f33695d3fc33"
+        reference_url = "https://citizenlab.ca/2013/02/apt1s-glasses-watching-a-human-rights-organization/"
 
     strings:
         $ = "thequickbrownfxjmpsvalzydg"
@@ -42,9 +47,11 @@ rule Glasses : Family
     meta:
         description = "Glasses family"
         author = "Seth Hardy"
-        last_modified = "2014-07-22"
+        last_modified = "2021-11-18"
+        reference_file = "aaf262fde1738dbf0bb50213a9624cd6705ebcaeb06c5fcaf7e9f33695d3fc33"
+        reference_url = "https://citizenlab.ca/2013/02/apt1s-glasses-watching-a-human-rights-organization/"
 
     condition:
-        GlassesCode or GlassesStrings
+        GlassesCode and GlassesStrings
         
 }