SEKOIA.IO unknown stable yara

apt_apt31_pakdoor [yara_rules]

Detects APT31 ORB implant - 2019/2021

View Source

Detection Logic

int32be(0) == 0x7f454c46 and 
        filesize < 800KB and 
        filesize > 400KB and 
        4 of ($s*)

Field Validations

Loading…

Comments (0)

Loading comments...