SEKOIA.IO unknown stable yara

apt_apt29_wineloader_malicious_pdf [yara_rules]

Detects malicious PDF used by APT29 to drop Wineloader

View Source

Detection Logic

uint32be(0) == 0x25504446 and
        $s2 in (@s1..@s3) and $s4

Field Validations

Loading…

Comments (0)

Loading comments...