SEKOIA.IO unknown stable yara

apt_andariel_keylogger_strings [yara_rules]

Detects one of the Andariel keylogger

View Source

Detection Logic

uint16be(0) == 0x4d5a and
        filesize < 300KB and
        2 of them

Field Validations

Loading…

Comments (0)

Loading comments...