SEKOIA.IO unknown stable yara

infostealer_win_vulturi [yara_rules]

Detect the Vulturi infostealer based on specific strings

View Source

Detection Logic

uint16(0)==0x5A4D and
        (#vul > 50 or 12 of ($str*))

Field Validations

Loading…

Comments (0)

Loading comments...