EquationDrug_CompatLayer_UnilayDLL

Description

EquationDrug - Unilay.DLL

Query · yara

strings:
		$s0 = "unilay.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and $s0
Raw source EquationDrug_CompatLayer_UnilayDLL · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule EquationDrug_CompatLayer_UnilayDLL {
	meta:
		description = "EquationDrug - Unilay.DLL"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
		date = "2015/03/11"
		hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
		id = "32fd31c7-cc44-50e1-8888-b9da59ce587b"
	strings:
		$s0 = "unilay.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and $s0
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.