ReversingLabs unknown stable yara
Win64_Backdoor_SideTwist [backdoor]
Yara rule that detects SideTwist backdoor.
Detection Logic
uint16(0) == 0x5A4D and
(
$anti_sandbox_detect_environment
) and
(
$collect_host_information
) and
(
$contact_c2_server
) and
(
$parse_c2_response
) and
(
all of ($download_file_from_c2_p*)
) and
(
$reply_to_c2_server
) Field Validations
Loading…
Comments (0)
Loading comments...