SEKOIA.IO unknown stable yara

infostealer_win_gomorrah [yara_rules]

Detect the Gomorrah infostealer based on specific strings

View Source

Detection Logic

uint16(0)==0x5A4D and
        ((1 of ($gom*) and 1 of ($str*)) or (7 of ($str*)))

Field Validations

Loading…

Comments (0)

Loading comments...