nuclei-templates/file/malware/intel-virtualization-malwar...

31 lines
969 B
YAML

id: intel-virtualization-malware
info:
name: Intel Virtualization Malware - Detect
author: daffainfo
severity: info
reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Intel_Virtualization.yar
tags: malware,file
file:
- extensions:
- all
matchers-condition: and
matchers:
- type: binary
binary:
- '4C6F6164535452494E47'
- '496E697469616C697A654B6579486F6F6B'
- '46696E645265736F7572636573'
- '4C6F6164535452494E4746726F6D484B4355'
- '6863637574696C732E444C4C'
condition: and
- type: binary
binary:
- '483A5C466173745C506C756728686B636D64295C'
- '646C6C5C52656C656173655C48696A61636B446C6C2E706462'
condition: and
# digest: 490a00463044022013d609856dcbea597a8972ccf79c7efbaf74a453066aa09f49f30de2d3ca41af022047495390e0f0cff609552ada8a7e3c8310f2bfb9322a392bbdd64db5f2140688:922c64590222798bb761d5b6d8e72950