Trojan_Win32_PlaKeylog_B

Description

Keylogger component

Query · yara

strings:
		$hook = {C6 06 FF 46 C6 06 25}
		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}

	condition:
		$hook and $dasm_engine
Raw source Trojan_Win32_PlaKeylog_B · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule Trojan_Win32_PlaKeylog_B : Platinum
{
	meta:
		author = "Microsoft"
		description = "Keylogger component"
		original_sample_sha1 = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
		unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "bc84ef20-f428-5f3d-bc88-ab14991a2350"
	strings:
		$hook = {C6 06 FF 46 C6 06 25}
		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}

	condition:
		$hook and $dasm_engine
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.