Update AutoIT.yar

Add new string to AutoIT_Script rule
CAPESandbox · Oct 17, 2023 · 5b2fc6a · 5b2fc6a
1 parent dbdce36
commit 5b2fc6a
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/data/yara/binaries/AutoIT.yar b/data/yara/binaries/AutoIT.yar
@@ -37,6 +37,7 @@ strings:
 	$ = ">>>AUTOIT NO CMDEXECUTE<<<" ascii wide
 	$ = ">>>AUTOIT SCRIPT<<<" ascii wide
 	$ = "This is a third-party compiled AutoIt script." ascii wide
+	$ = "AU3!EA06" ascii wide
 
 condition:
 	uint16(0) != 0x5A4D and any of them