SEKOIA.IO unknown stable yara

ta410_control_flow_obfuscation [yara_rules]

Detects control flow obfuscation used by TA410 in XXXModule_dlcore0

View Source

Detection Logic

uint16be(0) == 0x4d5a and filesize < 10MB and any of them

Field Validations

Loading…

Comments (0)

Loading comments...