SEKOIA.IO unknown stable yara

infostealer_win_eternity [yara_rules]

Detect the Eternity infostealer based on specific strings

View Source

Detection Logic

uint16(0)==0x5A4D and
        (for any i in (0..pe.number_of_sections-1) : ( pe.sections[i].name == ".eter0" ) and
        for any i in (0..pe.number_of_sections-1) : ( pe.sections[i].name == ".eter1" )) or 
        4 of ($str*)

Field Validations

Loading…

Comments (0)

Loading comments...