yara rules by malwared.ru