SEKOIA.IO unknown stable yara

infostealer_win_phoenixwave [yara_rules]

Detect the PhoenixWave infostealer based on specific strings

View Source

Detection Logic

uint16(0)==0x5A4D and
        7 of ($str*) and 8 of ($app*)

Field Validations

Loading…

Comments (0)

Loading comments...