Executable Masquerading as Image File
Detects specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files (e.g., mev.png, USO.ico, USO.png) to evade detection.
Sigma
Detects specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files (e.g., mev.png, USO.ico, USO.png) to evade detection.
Already have an account?