Signature Base unknown stable yara

SLServer_command_and_control [yara]

Searches for the C2 server.

View Source

Detection Logic

//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$c2

Field Validations

Loading…

Comments (0)

Loading comments...