Signature Base unknown stable yara

APT_APT29_NOBELIUM_NativeZone_Loader_May21_1 [yara]

Detects NativeZone loader as described in APT29 NOBELIUM report

View Source

Detection Logic

uint16(0) == 0x5a4d and
      filesize < 3000KB and 3 of them or 4 of them

Field Validations

Loading…

Comments (0)

Loading comments...