Signature Base unknown stable yara

APT_APT29_NOBELIUM_LNK_Samples_May21_1 [yara]

Detects link file characteristics as described in APT29 NOBELIUM report

View Source

Detection Logic

uint16(0) == 0x004c and
      filesize < 4KB and $a1 and 
      ( all of ($sa*) or all of ($sb*) or all of ($sc*) or all of ($sd*) or all of ($se*) )

Field Validations

Loading…

Comments (0)

Loading comments...