nuclei-templates/file/malware/intel-virtualization-malware.yaml

id: intel-virtualization-malware

info:
  name: Intel Virtualization Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Intel_Virtualization.yar
  tags: malware,file
file:
  - extensions:
      - all

    matchers-condition: and
    matchers:
      - type: binary
        binary:
          - '4C6F6164535452494E47'
          - '496E697469616C697A654B6579486F6F6B'
          - '46696E645265736F7572636573'
          - '4C6F6164535452494E4746726F6D484B4355'
          - '6863637574696C732E444C4C'
        condition: and

      - type: binary
        binary:
          - '483A5C466173745C506C756728686B636D64295C'
          - '646C6C5C52656C656173655C48696A61636B446C6C2E706462'
        condition: and
# digest: 490a0046304402200f3b564368c6bd6ba092de51b73f60b987331701236ad261efe8545d7a0a43e9022052edceb9f49f15e14cac3e07333c86a9d55dae618616caa6ea3dab357af03738:922c64590222798bb761d5b6d8e72950