Detect Shulfar Malware Encrypted TCP C&C Traffic Using PacketSmith Yara-X Detection Module

Shulfar (Netomize's name) malware encrypts its C&C traffic over the TCP protocol using a custom encryption algorithm and a fixed key. We took this as a challenge to write a detection rule targeting the encrypted message packet by simulating the decryption algorithm for all possible keys. submitt