ReversingLabs unknown stable yara

ByteCode_MSIL_Backdoor_AsyncRAT [backdoor]

Yara rule that detects AsyncRAT backdoor.

Detection Logic

uint16(0) == 0x5A4D and
        (
            (
                (
                    $read_server_data_v1
                ) and
                (
                    $send_v1
                ) and
                (
                    all of ($read_packet_v1_p*)
                )
            ) or
            (
                (
                    $send_v2
                ) and
                (
                    $open_url_v2
                ) and
                (
                    $monitoring_v2
                )
            )
        )

Field Validations

Loading…

Comments (0)

Loading comments...