nuclei-templates/file/malware/tedroo-malware.yaml

id: tedroo-malware

info:
  name: Tedroo Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Tedroo.yar
  tags: malware,file
file:
  - extensions:
      - all
    matchers:
      - type: binary
        binary:
          - "257325732E657865"
          - "5F6C6F672E747874"
        condition: and
# digest: 490a004630440220464dc5e61f85db5511f6b1220aff84180ebd768e527f95f5278e0328c7d7efcd0220465b90d5cfd1b6bb3b5bda8a254e8c7e7eb295683d42841926c7efc3a0059c7f:922c64590222798bb761d5b6d8e72950