Signature Base unknown stable yara

SUSP_LNK_lnkfileoverRFC [yara]

Detects APT lnk files that run double extraction and launch routines with autoruns

View Source

Detection Logic

uint16(0) == 0x004c and uint32(4) == 0x00021401 and
      filesize > 15KB and (
         2 of them
      )

Field Validations

Loading…

Comments (0)

Loading comments...