Signature Base unknown stable yara

dnscat2_Hacktool [yara]

Detects dnscat2 - from files dnscat, dnscat2.exe

View Source

Detection Logic

((uint16(0) == 0x457f or uint16(0) == 0x5a4d) and filesize < 400KB and (2 of ($s*))) or (all of them)

Field Validations

Loading…

Comments (0)

Loading comments...