id: gafgyt-hoho-malware

info:
  name: Gafgyt Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Gafgyt.yar
  tags: malware,file
file:
  - extensions:
      - all
    matchers:
      - type: word
        part: raw
        words:
          - 'PING'
          - 'PRIVMSG'
          - 'Remote IRC Bot'
          - '23.95.43.182'
        condition: and
# digest: 490a004630440220128a4099f0349e54cf630e3cfe1417fce1bf7450c2692bacb13f049b6276bd1c022027fd0602cb5da92b503c52d02c0e0ed5f3710036cb8419933226bd3b4e3703c7:922c64590222798bb761d5b6d8e72950