nuclei-templates/file/malware/intel-virtualization-malware.yaml

id: intel-virtualization-malware

info:
  name: Intel Virtualization Malware - Detect
  author: daffainfo
  severity: info
  reference:
    - https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Intel_Virtualization.yar
  tags: malware,file
file:
  - extensions:
      - all

    matchers-condition: and
    matchers:
      - type: binary
        binary:
          - '4C6F6164535452494E47'
          - '496E697469616C697A654B6579486F6F6B'
          - '46696E645265736F7572636573'
          - '4C6F6164535452494E4746726F6D484B4355'
          - '6863637574696C732E444C4C'
        condition: and

      - type: binary
        binary:
          - '483A5C466173745C506C756728686B636D64295C'
          - '646C6C5C52656C656173655C48696A61636B446C6C2E706462'
        condition: and
# digest: 4a0a004730450221009fe5e6fed1ad8a8ada1be972de7a279103df6907c72f5bf9b87fa77a991605d90220324e77ed582f7891c50ce4c51bde93e4252b4d2c5a977a0aa78c44b6e173d82e:922c64590222798bb761d5b6d8e72950