Signature Base unknown stable yara

MAL_3CXDesktopApp_MacOS_UpdateAgent_Mar23 [yara]

Detects 3CXDesktopApp MacOS UpdateAgent backdoor component

Detection Logic

uint16(0) == 0xfeca 
      and filesize < 6MB
      and (
         1 of ($x*)
         or ( $a1 and all of ($s*) )
      ) or all of them

Loading…

Loading comments...