RT @cyb3rops: I've included Matt's great rule in the public signature-base used by LOKI* and THOR* (*scanning process memory with YARA si…