ReversingLabs unknown stable yara

Win32_Infostealer_MultigrainPOS [infostealer]

Yara rule that detects MultigrainPOS infostealer.

View Source

Detection Logic

uint16(0) == 0x5A4D and
            (($data_exfiltration_v10_1 and $memory_scraping_v10_1 and $process_search_v10_1 and $service_creation_v10_1) or
            ($process_search_v11_1 and $memory_scraping_v11_1 and $data_exfiltration_v11_1 and $service_creation_v11_1))

Field Validations

Loading…

Comments (0)

Loading comments...