SEKOIA.IO unknown stable yara

apt_gamaredon_lnks_farl139_hostname [yara_rules]

Detects some hostname used in Gamaredon LNKs

View Source

Detection Logic

uint32be(0) == 0x4c000000
        and all of them 
        and filesize < 10KB

Field Validations

Loading…

Comments (0)

Loading comments...