Signature Base unknown stable yara

APT_APT29_NOBELIUM_JS_EnvyScout_May21_1 [yara]

Detects EnvyScout deobfuscator code as used by NOBELIUM group

View Source

Detection Logic

filesize < 5000KB and 1 of them

Field Validations

Loading…

Comments (0)

Loading comments...