nuclei-templates/file/malware/smallnet-malware.yaml

28 lines
554 B
YAML

id: smallnet-malware
info:
name: SmallNet Malware - Detect
author: daffainfo
severity: info
reference: https://github.com/Yara-Rules/rules/blob/master/malware/RAT_Ratdecoders.yar
tags: malware,file
file:
- extensions:
- all
matchers:
- type: word
part: raw
words:
- "!!<3SAFIA<3!!"
- "!!ElMattadorDz!!"
condition: or
- type: word
part: raw
words:
- "stub_2.Properties"
- "stub.exe"
- "get_CurrentDomain"
condition: and