Merge pull request #4 from wireghoul/patch-1

Update php.yar
nbs-system · Jan 17, 2021 · 7d1b78f · 7d1b78f
2 parents 5a7f130 + 2c578c4
commit 7d1b78f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
@@ -313,6 +313,7 @@ rule DodgyStrings
         $ = "kernel32.dll" fullword nocase
         $ = "kingdefacer" nocase
         $ = "Wireghoul" nocase fullword
+        $ = "htshell" nocase fullword
         $ = "LD_PRELOAD" fullword
         $ = "libpcprofile"  // CVE-2010-3856 local root
         $ = "locus7s" nocase
@@ -375,4 +376,3 @@ rule Websites
     condition:
         (any of them) and not IsWhitelisted
 }
-