SEKOIA.IO unknown stable yara

apt_andariel_dorarat_strings [yara_rules]

Detects Dora RAT based on strings

View Source

Detection Logic

uint16be(0) == 0x4d5a and
        (all of ($x*) or $enc_rsc)

Field Validations

Loading…

Comments (0)

Loading comments...