(YARA) Detect_Interrupts

Download Raw

rule Detect_Interrupt: AntiDebug {
    meta: 
        description = "Detect Interrupt instruction"
        author = "Unprotect"
        comment = "Experimental rule / the rule can be slow to use"
    strings:
        $int3 = { CC }
        $intCD = { CD }
        $int03 = { 03 }
        $int2D = { 2D }
        $ICE = { F1 }
    condition:   
       uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
INT3 Instruction Scanning U0105 B0001.025
INT 0x2D U0129 B0001.006
ICE 0xF1 U0130

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
WhatsApp.exe 4 2025-07-11 20 hours, 29 minutes ago
Real Ghost Hollowing Test Notepad Calc.exe 6 2025-07-05 6 days, 8 hours ago
Клиент.exe 9 2025-07-01 1 week, 3 days ago
binary2.exe 7 2025-06-28 2 weeks ago
ArtifactDLL.x64.dll 5 2025-06-20 3 weeks ago
Artifact.exe 5 2025-06-20 3 weeks ago
wireguard-installer.exe 7 2025-06-12 4 weeks, 1 day ago
131da83b521f610819141d5c7403...abb22ef504a7593955a65f07.exe 9 2025-06-12 4 weeks, 1 day ago
MSBuild.exe 10 2024-11-15 4 weeks, 1 day ago
main.exe 4 2025-06-10 1 month ago
View All

Created

June 22, 2022

Last Revised

June 22, 2022