Skip to content

Instantly share code, notes, and snippets.

@idiom

idiom/reactor.yara

Created February 2, 2024 00:27
Show Gist options
  • Save idiom/147d621eee926f9623a5707600312ff0 to your computer and use it in GitHub Desktop.
Save idiom/147d621eee926f9623a5707600312ff0 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
reactor.yara
import "dotnet"
rule net_reactor_obfuscated {
strings:
$s1 = "#GUlD" fullword
$s2 = "#GUID" fullword
$s3 = "#Blop" fullword
$s4 = "#Blob" fullword
condition:
dotnet.is_dotnet and all of them
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment