SEKOIA.IO unknown stable yara

apt_lazarus_dangerouspassword_lnk [yara_rules]

Detects Lazarus DangerousPassword LNKs

View Source

Detection Logic

uint32be(0)== 0x4C000000 and
        filesize > 1KB and filesize < 40MB and
        (all of ($s*) or $b1 or ($s1 and $c1))

Field Validations

Loading…

Comments (0)

Loading comments...