YARA unknown stable yara

Check_DriveSize [antidebug_antivm]

View Source

Detection Logic

pe.imports("kernel32.dll","CreateFileA") and
		pe.imports("kernel32.dll","DeviceIoControl") and
		$dwIoControlCode and
		$physicaldrive

Field Validations

Loading…

Comments (0)

Loading comments...