Signature Base unknown stable yara

MAL_ELF_LNX_Mirai_Oct10_1 [yara]

Detects ELF Mirai variant

View Source

Detection Logic

uint16(0) == 0x457f and filesize < 200KB and (
         ( 1 of ($x*) and 1 of ($s*) ) or
         all of ($x*)
      )

Field Validations

Loading…

Comments (0)

Loading comments...