Update Rclone.yar

bartblaze · Jan 8, 2024 · 358876e · 358876e
1 parent 8541921
commit 358876e
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/rules/generic/Rclone.yar b/rules/generic/Rclone.yar
@@ -15,8 +15,7 @@ rule Rclone
         source = "BARTBLAZE"
         author = "@bartblaze"
         description = "Identifies Rclone, sometimes used by attackers to exfiltrate data."
-        category = "MALWARE"
-        malware_type = "INFOSTEALER"
+        category = "INFO"
         reference = "https://rclone.org/"
 
 
@@ -29,4 +28,4 @@ rule Rclone
 
     condition:
         any of them or for any i in (0..pe.number_of_resources-1) : (pe.resources[i].type==pe.RESOURCE_TYPE_ICON and hash.md5(pe.resources[i].offset,pe.resources[i].length)=="fc675e36c61c8b9d0b956bd05695cdda")
-}
+}