nuclei-templates/file/malware/intel-virtualization-malware.yaml

id: intel-virtualization-malware

info:
  name: Intel Virtualization Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Intel_Virtualization.yar
  tags: malware,file

file:
  - extensions:
      - all

    matchers-condition: and
    matchers:
      - type: binary
        binary:
          - '4C6F6164535452494E47'
          - '496E697469616C697A654B6579486F6F6B'
          - '46696E645265736F7572636573'
          - '4C6F6164535452494E4746726F6D484B4355'
          - '6863637574696C732E444C4C'
        condition: and

      - type: binary
        binary:
          - '483A5C466173745C506C756728686B636D64295C'
          - '646C6C5C52656C656173655C48696A61636B446C6C2E706462'
        condition: and