(YARA) YARA_Detect_ExceptionHandler
rule Detect_SuspendThread: AntiDebug {
meta:
description = "Detect SuspendThread as anti-debug"
author = "Unprotect"
comment = "Experimental rule"
strings:
$1 = "UnhandledExcepFilter" fullword ascii
$2 = "SetUnhandledExceptionFilter" fullword ascii
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
Unhandled Exception Filter | U0108 B0001.030 |
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
libEGL.dll | 8 | 2025-02-12 | 12 hours, 26 minutes ago |
1663704907_themetool.exe | 6 | 2025-01-20 | 3 weeks, 3 days ago |
Stellaris v2.3.0-v3.12.5 Plus 24 Trainer.exe | 8 | 2025-01-18 | 3 weeks, 4 days ago |
ZClient.exe | 12 | 2025-01-13 | 1 month ago |
Crackme#7.exe | 8 | 2025-01-12 | 1 month ago |
Temp_1.exe | 7 | 2025-01-06 | 1 month, 1 week ago |
kernel32.dll | 13 | 2024-12-30 | 1 month, 1 week ago |
hello.exe | 8 | 2024-12-27 | 1 month, 2 weeks ago |
PerunsFart.exe | 6 | 2024-12-25 | 1 month, 2 weeks ago |
avbox.exe | 6 | 2024-12-11 | 2 months ago |
Created
June 22, 2022
Last Revised
June 22, 2022