Skip to content

Instantly share code, notes, and snippets.

@itsreallynick

itsreallynick/help_Elm0d.yara

Last active August 30, 2017 03:07
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save itsreallynick/b329b529363cbc1b8515d20852fb8c5e to your computer and use it in GitHub Desktop.
Save itsreallynick/b329b529363cbc1b8515d20852fb8c5e to your computer and use it in GitHub Desktop.
Download ZIP
Elm0d the Researcher
Raw
help_Elm0d.yara
rule help_Elm0d
{
meta:
author = "@ItsReallyNick - Nick Carr"
description = "We are STILL helping https://twitter.com/Elm0D find his files"
reference = "https://twitter.com/ItsReallyNick/status/902702954272223232"
strings:
$elm0d = /[^a-z0-9]elm0d[^a-z0-9]/ nocase ascii wide
$lol_infra = "iso9001-certificare.ro" nocase ascii wide
$lol_website = "www.elm0d.tk" nocase ascii wide
condition:
(filesize < 10MB)
and(
((#elm0d > 1)
or
(any of ($lol*)))
)
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment