(YARA) Detect_Interrupts
rule Detect_Interrupt: AntiDebug {
meta:
description = "Detect Interrupt instruction"
author = "Unprotect"
comment = "Experimental rule / the rule can be slow to use"
strings:
$int3 = { CC }
$intCD = { CD }
$int03 = { 03 }
$int2D = { 2D }
$ICE = { F1 }
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
INT3 Instruction Scanning | U0105 B0001.025 | ||
INT 0x2D | U0129 B0001.006 | ||
ICE 0xF1 | U0130 |
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
Клиент.exe | 9 | 2025-07-01 | 4 days, 1 hour ago |
binary2.exe | 7 | 2025-06-28 | 1 week ago |
ArtifactDLL.x64.dll | 5 | 2025-06-20 | 2 weeks, 1 day ago |
Artifact.exe | 5 | 2025-06-20 | 2 weeks, 1 day ago |
wireguard-installer.exe | 7 | 2025-06-12 | 3 weeks, 2 days ago |
131da83b521f610819141d5c7403...abb22ef504a7593955a65f07.exe | 9 | 2025-06-12 | 3 weeks, 2 days ago |
MSBuild.exe | 10 | 2024-11-15 | 3 weeks, 2 days ago |
main.exe | 4 | 2025-06-10 | 3 weeks, 4 days ago |
RuntimeBroker.exe | 11 | 2025-06-05 | 1 month ago |
tel.exe | 13 | 2025-06-01 | 1 month ago |
Created
June 22, 2022
Last Revised
June 22, 2022