SEKOIA.IO unknown stable yara

rat_win_ratel_strings [yara_rules]

Detect RATel based on characteristic strings

View Source

Detection Logic

(uint16be(0) == 0x4d5a) and
        filesize > 500KB and filesize < 3MB and
        8 of them

Field Validations

Loading…

Comments (0)

Loading comments...