[clamav-users] Anyone have a good script for encrypted zip Emotet files?

[eric-list at truenet.com]

I started writing my own, but of course I'm not catching them all.

Example of my YARA file is here: https://pastebin.com/MKTbKiNX

 

If anyone is willing to share a more comprehensive rule I would appreciate
it.

 

Sincerely,

 

Eric Tykwinski

TrueNet, Inc.

P: 610-429-8300

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20200922/bd7447af/attachment.htm>