SEKOIA.IO unknown stable yara

apt_spikedwine_wineloader [yara_rules]

Detects vineloader

View Source

Detection Logic

pe.is_dll() and
        filesize < 100KB and
        for any export in pe.export_details: (
            $c in (export.offset..export.offset+100)
        )

Field Validations

Loading…

Comments (0)

Loading comments...