SEKOIA.IO unknown stable yara

lnk_astaroth [yara_rules]

Astaroth LNK

View Source

Detection Logic

uint32be(0) == 0x4c000000 and filesize<3KB and all of ($all*) and
        ((all of ($ver2*) and #ver2_5 > 20) or (all of ($ver1*) and #ver1_5 > 20 and #ver1_6 > 7))

Field Validations

Loading…

Comments (0)

Loading comments...