BabylonRAT XOR-obfuscated capability strings

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

Detects executable files containing XOR-obfuscated strings associated with BabylonRAT capabilities, including browser credential theft, keylogging, HOSTS file manipulation, DDoS, and remote dynamic API resolution. This rule identifies patterns commonly used to evade static analysis.