malduck
malduck copied to clipboard
Retrieving XOR key from yara engine
Summary
Consider the following yara rule,
rule example {
strings:
$xor = "hello world!" xor
condition:
any of them
}
When using yara-python
, one could fetch the found XOR key from the xor_key property from a StringMatchInstance object. This property does not appear to be passed to the yara wrapper in malduck yet?