SEKOIA.IO unknown stable yara

icedid_chm_ttp [yara_rules]

IcedID campaign delivering ISO file with CHM attack chain

View Source

Detection Logic

3 of ($hta*) and all of ($chm*) and magic.mime_type() == "application/x-iso9660-image" and filesize > 500KB

Field Validations

Loading…

Comments (0)

Loading comments...