SEKOIA.IO unknown stable yara

apt_apt33_tickler [yara_rules]

Detects APT33 Tickler malware

View Source

Detection Logic

uint16be(0) == 0x4d5a and
        (hash.md5(pe.rich_signature.clear_data) == "2fe65623e6b22577516a4cd051ec3baa"
        or pe.imphash() == "a5accd1a0d3eaf2c131bc662dd7ff8ea")

Field Validations

Loading…

Comments (0)

Loading comments...