(YARA) Detect_Interrupts

Download Raw

rule Detect_Interrupt: AntiDebug {
    meta: 
        description = "Detect Interrupt instruction"
        author = "Unprotect"
        comment = "Experimental rule / the rule can be slow to use"
    strings:
        $int3 = { CC }
        $intCD = { CD }
        $int03 = { 03 }
        $int2D = { 2D }
        $ICE = { F1 }
    condition:   
       uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
INT3 Instruction Scanning U0105 B0001.025
INT 0x2D U0129 B0001.006
ICE 0xF1 U0130

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
Клиент.exe 9 2025-07-01 4 days, 1 hour ago
binary2.exe 7 2025-06-28 1 week ago
ArtifactDLL.x64.dll 5 2025-06-20 2 weeks, 1 day ago
Artifact.exe 5 2025-06-20 2 weeks, 1 day ago
wireguard-installer.exe 7 2025-06-12 3 weeks, 2 days ago
131da83b521f610819141d5c7403...abb22ef504a7593955a65f07.exe 9 2025-06-12 3 weeks, 2 days ago
MSBuild.exe 10 2024-11-15 3 weeks, 2 days ago
main.exe 4 2025-06-10 3 weeks, 4 days ago
RuntimeBroker.exe 11 2025-06-05 1 month ago
tel.exe 13 2025-06-01 1 month ago
View All

Created

June 22, 2022

Last Revised

June 22, 2022