SEKOIA.IO unknown stable yara

apt_flightnight_malicious_lnk [yara_rules]

Detects malicious LNK used by FlightNight

View Source

Detection Logic

uint32be(0) == 0x4c000000 and
        $s1 in (@s0..@s2) and
        $s1 in (@s0..@s0+100) and
        $s3

Field Validations

Loading…

Comments (0)

Loading comments...