diff --git a/malware/MALW_Glasses.yar b/malware/MALW_Glasses.yar index ede7bba9..82a1dfc9 100644 --- a/malware/MALW_Glasses.yar +++ b/malware/MALW_Glasses.yar @@ -5,12 +5,15 @@ import "pe" -rule GlassesCode : Glasses Family +private rule GlassesCode : Glasses Family { meta: description = "Glasses code features" author = "Seth Hardy" - last_modified = "2014-07-22" + last_modified = "2021-11-18" + reference_file = "aaf262fde1738dbf0bb50213a9624cd6705ebcaeb06c5fcaf7e9f33695d3fc33" + reference_url = "https://citizenlab.ca/2013/02/apt1s-glasses-watching-a-human-rights-organization/" + strings: $ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 } @@ -25,7 +28,9 @@ rule GlassesStrings : Glasses Family meta: description = "Strings used by Glasses" author = "Seth Hardy" - last_modified = "2014-07-22" + last_modified = "2021-11-18" + reference_file = "aaf262fde1738dbf0bb50213a9624cd6705ebcaeb06c5fcaf7e9f33695d3fc33" + reference_url = "https://citizenlab.ca/2013/02/apt1s-glasses-watching-a-human-rights-organization/" strings: $ = "thequickbrownfxjmpsvalzydg" @@ -42,9 +47,11 @@ rule Glasses : Family meta: description = "Glasses family" author = "Seth Hardy" - last_modified = "2014-07-22" + last_modified = "2021-11-18" + reference_file = "aaf262fde1738dbf0bb50213a9624cd6705ebcaeb06c5fcaf7e9f33695d3fc33" + reference_url = "https://citizenlab.ca/2013/02/apt1s-glasses-watching-a-human-rights-organization/" condition: - GlassesCode or GlassesStrings + GlassesCode and GlassesStrings }