nuclei-templates/file/malware/luxnet-malware.yaml

24 lines
484 B
YAML

id: luxnet-malware
info:
name: LuxNet Malware - Detect
author: daffainfo
severity: info
reference: https://github.com/Yara-Rules/rules/blob/master/malware/RAT_Ratdecoders.yar
tags: malware,file
file:
- extensions:
- all
matchers:
- type: word
part: raw
words:
- "GetHashCode"
- "Activator"
- "WebClient"
- "op_Equality"
- "dickcursor.cur"
- "{0}|{1}|{2}"
condition: and