Re:Taking apart a double zero-day sample discovered in joint...
by badrabbit on Wednesday July 04, 2018 @06:20PM
(#17459724)
Not just using yara rules but any file in VT you can find by hash,name,etc... And you get extra metadata like where it was uploaded from.
Re:Taking apart a double zero-day sample discovered in joint...
by juliusmusseau on Wednesday July 04, 2018 @05:53PM
(#17459624)
Thanks for the explanation. Very helpful!
Lets assume you know a threat actor always uses the same variable names during heap sprays, you can discover new malware from this threat actor with a Yara rule to look for this pattern.