SEKOIA.IO unknown stable yara

infostealer_win_nekostealer [yara_rules]

Detect the NekoStealer infostealer based on specific strings

View Source

Detection Logic

uint16(0) == 0x5A4D and (#nek > 10 or all of ($str*))

Field Validations

Loading…

Comments (0)

Loading comments...