YARA · Frank Boldewin (R3c0nst)
R3C0NST_Aplib_Decompression
Detects aPLib decompression code often used in malware
- Author
- @r3c0nst
- Date
- 2021-03-24
- Modified
- 2021-03-25
- Score / Quality
- 75 / 90
What this rule detects
Detects aPLib decompression code often used in malware
It defines 3 patterns (0 text, 3 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Frank Boldewin (R3c0nst), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: @r3c0nst
Source repository: Frank Boldewin (R3c0nst) @ 54e9e6899b
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: f45c73f5-d316-5fea-a8c4-fd930733415f
Tags:FILE