ReversingLabs unknown stable yara

Win32_Virus_Mocket [virus]

Yara rule that detects Mocket virus.

View Source

Detection Logic

uint16(0) == 0x5A4D and ($mocket_body_1 at pe.entry_point) and $mocket_body_2 and $mocket_body_3

Field Validations

Loading…

Comments (0)

Loading comments...