ReversingLabs unknown stable yara

Win32_Infostealer_ProjectHookPOS [infostealer]

Yara rule that detects ProjectHookPOS infostealer.

View Source

Detection Logic

uint16(0) == 0x5A4D and
        ($calc_luhn and $track_1_reverse and $check_validity_1 and $encode_and_send_1 and
        $form_create_1 and $form_create_2 and $form_create_3)

Field Validations

Loading…

Comments (0)

Loading comments...