ReversingLabs unknown stable yara

ByteCode_MSIL_Backdoor_OrcusRAT [backdoor]

Yara rule that detects OrcusRAT backdoor.

View Source

Detection Logic

uint16(0) == 0x5A4D and
        (
            (
                $get_tcp_connections
            ) or
            (
                all of ($get_operating_system_information_p*)
            ) or          
            (
                $take_screenshot
            ) or
            (
                $get_passwords
            ) or
            (
                $process_key_action
            )
        )

Field Validations

Loading…

Comments (0)

Loading comments...