SEKOIA.IO unknown stable yara

apt_37_chinotto [yara_rules]

Detects obfuscation and string of APT37 stealer

View Source

Detection Logic

(uint32be(0) == 0x7f454c46 or uint16be(0) == 0x4d5a) and
        filesize < 1MB and ($chunk_1 or $chunk_2) and $movs_zip_dir_start

Field Validations

Loading…

Comments (0)

Loading comments...