Signature Base unknown stable yara

Agent_BTZ_Proxy_DLL_2 [yara]

Detects Agent-BTZ Proxy DLL - activeds.dll

View Source

Detection Logic

uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.imphash() == "09b7c73fbe5529e6de7137e3e8268b7b"

Field Validations

Loading…

Comments (0)

Loading comments...