nuclei-templates/file/malware/zoxpng-malware.yaml

19 lines
460 B
YAML

id: zoxpng-malware
info:
name: ZoxPNG Malware - Detect
author: daffainfo
severity: info
reference: https://github.com/Yara-Rules/rules/blob/master/malware/RAT_ZoxPNG.yar
tags: malware,file
file:
- extensions:
- all
matchers:
- type: word
part: raw
words:
- "png&w=800&h=600&ei=CnJcUcSBL4rFkQX444HYCw&zoom=1&ved=1t:3588,r:1,s:0,i:92&iact=rc&dur=368&page=1&tbnh=184&tbnw=259&start=0&ndsp=20&tx=114&ty=58"