SEKOIA.IO unknown stable yara

rootkit_win_purplefox_kernel_driver [yara_rules]

Detect the Purple Fox trojan

View Source

Detection Logic

//Native
        uint16(0)==0x5A4D and all of them
        
        // Console
        or (
            pe.rich_signature.toolid(171, 30319)
            and pe.rich_signature.toolid(158, 30319)
            and pe.rich_signature.toolid(170, 30319)
            and pe.rich_signature.toolid(147, 30729)
            and pe.rich_signature.toolid(1, 0)
        )
        and for any i in (0..pe.number_of_signatures-1) : (
            pe.signatures[i].thumbprint == "c7939f8303ca22effb28246e970b13bee6cb8043"
        )

Field Validations

Loading…

Comments (0)

Loading comments...