Signature Base unknown stable yara

APT_APT29_NOBELIUM_Stageless_Loader_May21_2 [yara]

Detects stageless loader as used by APT29 / NOBELIUM

View Source

Detection Logic

uint16(0) == 0x5a4d and
      filesize < 900KB and
      2 of them or 3 of them

Field Validations

Loading…

Comments (0)

Loading comments...