Signature Base unknown stable yara

HiddenCobra_BANKSHOT_Gen [yara]

Detects Hidden Cobra BANKSHOT trojan

View Source

Detection Logic

uint16(0) == 0x5a4d and filesize < 500KB and (
         1 of ($x*) or
         2 of ($s*) or
         4 of ($a*)
      )

Field Validations

Loading…

Comments (0)

Loading comments...