SEKOIA.IO unknown stable yara

apt_apt31_rekoobe [yara_rules]

Find Rekoobe sample via Trend Elf Hash (telfhash)

View Source

Detection Logic

uint32be(0) == 0x7f454c46 and
        filesize < 100KB and elf.telfhash() == "t18fc080c7c6b56a34a7f32538ac7c407982035e1581561b207f50c955d93b408404c5ef"

Field Validations

Loading…

Comments (0)

Loading comments...