instr.opcode[.]nameDomain
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
From APT28 to RePythonNET: automating .NET malware analysis“if instr.OpCode[.]Name == "ldsfld":”
-
Advent of Configuration Extraction, Part 2: QuasarRAT Config“By comparing the opcode name as a string, e.g.: instr.OpCode[.]Name == "ldstr".”
Indicators reported together
named in the same reports- instr.operand[.]namein 2 reports
- hxxps://github[.]com/SEKOIA-IO/RePythonNET-MCPin 1 report
- x.opcode[.]namein 1 report
- 69609e89b04d8d27…cf3303be8906in 1 report
- vb[.]netin 1 report
- main.test[.]namein 1 report
- field[.]namein 1 report
- 4ef44bf6815e7860…912c38ac9639in 1 report
- mtype[.]namein 1 report
- instr.operand.declaringtype[.]namein 1 report
- typedef[.]namein 1 report
- method[.]namein 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.