SEKOIA.IO unknown stable yara

ursnif [yara_rules]

Ursnif Payload

View Source

Detection Logic

true and uint16(0) == 0x5A4D and (($decrypt_config64 and any of ($crypto64*)) or ($decrypt_config32 and any of ($crypto32*)))

Field Validations

Loading…

Comments (0)

Loading comments...