SEKOIA.IO unknown stable yara

apt_gamaredon_flash_infostealer [yara_rules]

Detects the Gamaredon's Flash InfoStealer

View Source

Detection Logic

uint16be(0) == 0x4d5a and filesize < 500KB and
        2 of ($a*) and 2 of ($w*)

Field Validations

Loading…

Comments (0)

Loading comments...