(YARA) Detect_Interrupts
rule Detect_Interrupt: AntiDebug {
meta:
description = "Detect Interrupt instruction"
author = "Unprotect"
comment = "Experimental rule / the rule can be slow to use"
strings:
$int3 = { CC }
$intCD = { CD }
$int03 = { 03 }
$int2D = { 2D }
$ICE = { F1 }
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
INT3 Instruction Scanning | U0105 B0001.025 | ||
INT 0x2D | U0129 B0001.006 | ||
ICE 0xF1 | U0130 |
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
AIEngineDestroyer.exe | 5 | 2025-07-17 | 1 day, 11 hours ago |
AIEngineDestroyer.exe | 5 | 2025-07-17 | 1 day, 15 hours ago |
AIEngineDestroyer.exe | 5 | 2025-07-17 | 1 day, 15 hours ago |
IObitUnlocker.sys | 5 | 2025-07-12 | 6 days, 3 hours ago |
ePSXe.exe | 7 | 2025-07-12 | 6 days, 19 hours ago |
WhatsApp.exe | 4 | 2025-07-11 | 1 week ago |
Real Ghost Hollowing Test Notepad Calc.exe | 6 | 2025-07-05 | 1 week, 6 days ago |
Клиент.exe | 9 | 2025-07-01 | 2 weeks, 3 days ago |
binary2.exe | 7 | 2025-06-28 | 2 weeks, 6 days ago |
ArtifactDLL.x64.dll | 5 | 2025-06-20 | 4 weeks ago |
Created
June 22, 2022
Last Revised
June 22, 2022