SEKOIA.IO unknown stable yara

apt_apt28_susp_graphite_downloader [yara_rules]

Matches the routine which decrypts the RSA key blob in the Graphite downloader

View Source

Detection Logic

uint16be(0) == 0x4d5a and $gen and pe.number_of_exports == 1

Field Validations

Loading…

Comments (0)

Loading comments...