SEKOIA.IO unknown stable yara

infostealer_win_xfiles [yara_rules]

Detect the X-FILES infostealer based on specific strings

View Source

Detection Logic

uint16(0)==0x5A4D and 
        any of ($xfi*) or 
        5 of ($brw*) and 20 of ($crp*)

Field Validations

Loading…

Comments (0)

Loading comments...