Signature Base unknown stable yara

MAL_UNC2891_Caketap [yara]

Detects UNC2891 Rootkit Caketap

View Source

Detection Logic

uint32 (0) ==  0x464c457f and (all of ($code*) or (all of ($str*) and #str2 == 2))

Field Validations

Loading…

Comments (0)

Loading comments...