(YARA) YARA_Detect_LocalSize
rule Detect_LocalSize: AntiDebug {
meta:
description = "Detect LocalSize as anti-debug"
author = "Unprotect"
comment = "Experimental rule"
strings:
$1 = "LocalSize" fullword ascii
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and $1
}
Associated Techniques
| Technique Name | Technique ID's | Snippet(s) | OS |
|---|---|---|---|
| LocalSize(0) | U0128 |
Matching Samples 10 most recent
| Sample Name | Matching Techniques | First Seen | Last Seen |
|---|---|---|---|
| al-khaser.exe | 24 | 2024-11-13 | 11 months, 2 weeks ago |
Created
June 22, 2022
Last Revised
June 22, 2022