SEKOIA.IO unknown stable yara

apt_nobelium_acrobox_downloader_apr2022 [yara_rules]

Detects AcroBox downloader

View Source

Detection Logic

uint16be(0) == 0x4d5a and
        filesize < 200KB and
        all of ($s*)

Field Validations

Loading…

Comments (0)

Loading comments...