idiom · June 21, 2017 04:14
diff --git a/rules.yara b/rules.yara
 rule rarsfx{
 strings:
  $markerold = {52 45 7e 5e}
  $markernew = {52 61 72 21 1a 07 (00|01|02)}
 condition:
  $markerold or $markernew in (0..0x100000)
 }
	rule rarsfx{
	strings:
	$markerold = {52 45 7e 5e}
	$markernew = {52 61 72 21 1a 07 (00\|01\|02)}
	condition:
	$markerold or $markernew in (0..0x100000)
	}