Signature Base unknown stable yara

APT_APT29_NOBELIUM_JS_EnvyScout_May21_2 [yara]

Detects EnvyScout deobfuscator code as used by NOBELIUM group

View Source

Detection Logic

filesize < 5000KB and all of them

Field Validations

Loading…

Comments (0)

Loading comments...