(YARA) Detect_Interrupts

Download Raw

rule Detect_Interrupt: AntiDebug {
    meta: 
        description = "Detect Interrupt instruction"
        author = "Unprotect"
        comment = "Experimental rule / the rule can be slow to use"
    strings:
        $int3 = { CC }
        $intCD = { CD }
        $int03 = { 03 }
        $int2D = { 2D }
        $ICE = { F1 }
    condition:   
       uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
INT3 Instruction Scanning U0105 B0001.025
INT 0x2D U0129 B0001.006
ICE 0xF1 U0130

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
AIEngineDestroyer.exe 5 2025-07-17 1 day, 11 hours ago
AIEngineDestroyer.exe 5 2025-07-17 1 day, 15 hours ago
AIEngineDestroyer.exe 5 2025-07-17 1 day, 15 hours ago
IObitUnlocker.sys 5 2025-07-12 6 days, 3 hours ago
ePSXe.exe 7 2025-07-12 6 days, 19 hours ago
WhatsApp.exe 4 2025-07-11 1 week ago
Real Ghost Hollowing Test Notepad Calc.exe 6 2025-07-05 1 week, 6 days ago
Клиент.exe 9 2025-07-01 2 weeks, 3 days ago
binary2.exe 7 2025-06-28 2 weeks, 6 days ago
ArtifactDLL.x64.dll 5 2025-06-20 4 weeks ago
View All

Created

June 22, 2022

Last Revised

June 22, 2022