SEKOIA.IO unknown stable yara

apt_andariel_nestdoor_variants_strings [yara_rules]

Detects Nestdoor based on (weak) strings

View Source

Detection Logic

(uint32be(0) == 0x7f454c46 or uint16be(0) == 0x4d5a) and
        (all of ($v_1*) or all of ($v_2*))

Field Validations

Loading…

Comments (0)

Loading comments...