From f81cb040c47fecfda5f5f071c991a66c911fb5f8 Mon Sep 17 00:00:00 2001
From: Lin <contact@who.ad>
Date: Wed, 26 Mar 2025 11:42:31 +0100
Subject: [PATCH] Update signatures/common.yara

---
 signatures/common.yara | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/signatures/common.yara b/signatures/common.yara
index 9b51fb5..9c7370d 100644
--- a/signatures/common.yara
+++ b/signatures/common.yara
@@ -15,6 +15,9 @@ rule CHINESE_NEZHA_ARGO {
         $a13 = "Server\x20is\x20running\x20on\x20port\x20"
         $a14 = "nysteria2"
         $a15 = "openssl req"
+        $a16 = "hysteria2"
+        $a17 = "NEZHA" nocase
+        $a18 = "babama1001980"
     condition:
         2 of ($a*)
 }