Added back Wireghoul

nbs-system · Jan 17, 2021 · 2c578c4 · 2c578c4
1 parent 92a74b3
commit 2c578c4
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
@@ -312,6 +312,7 @@ rule DodgyStrings
         $ = "ipconfig" fullword nocase
         $ = "kernel32.dll" fullword nocase
         $ = "kingdefacer" nocase
+        $ = "Wireghoul" nocase fullword
         $ = "htshell" nocase fullword
         $ = "LD_PRELOAD" fullword
         $ = "libpcprofile"  // CVE-2010-3856 local root
@@ -375,4 +376,3 @@ rule Websites
     condition:
         (any of them) and not IsWhitelisted
 }
-