SEKOIA.IO unknown stable yara

implant_win_knotweed_jumplump [yara_rules]

View Source

Detection Logic

uint16(0)==0x5A4D
        and pe.number_of_sections == 7
        and all of ($s*)
        and 1 of ($api_hash*)

Field Validations

Loading…

Comments (0)

Loading comments...