nuclei-templates/file/malware/unrecom-malware.yaml

24 lines
483 B
YAML

id: unrecom-malware
info:
name: Unrecom Malware - Detect
author: daffainfo
severity: info
reference: https://github.com/Yara-Rules/rules/blob/master/malware/RAT_Ratdecoders.yar
tags: malware,file
file:
- extensions:
- all
matchers:
- type: word
part: raw
words:
- "META-INF"
- "load/ID"
- "load/JarMain.class"
- "load/MANIFEST.MF"
- "plugins/UnrecomServer.class"
condition: and