Signature Base unknown stable yara

APT_Backdoor_MacOS_GORAT_1 [yara]

This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT

View Source

Detection Logic

((uint32(0) == 0xBEBAFECA) or (uint32(0) == 0xFEEDFACE) or (uint32(0) == 0xFEEDFACF) or (uint32(0) == 0xCEFAEDFE)) and all of them

Field Validations

Loading…

Comments (0)

Loading comments...