// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://www.mend.io/blog/theres-a-new-stealer-variant-in-town-and-its-using-electron-to-stay-fully-undetected/
meta("archive", "Asar Archive (Electron)");

function detect() {
    if (Binary.getSize() >= 28) {
        if (Binary.compare("04..............................'{\"files\":{'")) {
            bDetected = true;
        }
    }

    return result();
}
