SEKOIA.IO unknown stable yara

apt_agent_racoon_strings [yara_rules]

Detects Agent Racoon used by CL-STA-0002

View Source

Detection Logic

uint16be(0) == 0x4d5a and
        filesize < 1MB and
        all of them

Field Validations

Loading…

Comments (0)

Loading comments...