100daysofyara 2025
@100daysyara20250 followers637 downloads15 copies0 likes1,449 views
46 detections
Filters
Last updated
All Time
Detection languages
46
Categories
24
12
5
5
4
Platforms
28
10
7
5
1
Products / Services
4
3
3
3
3
MITRE Techniques
18
10
10
7
5
CVEs
2
2
day0 ToxicEyeRAT
YARA
These YARA rules detect the ToxicEye Remote Access Trojan (RAT), a malicious tool written in C# that leverages the Telegram Bot API for command and control. The rules identify specific hardcoded configuration settings (Telegram bot tokens, addresses for crypto wallets, persistence settings, and file grabber configurations), unique project strings (author attribution, warning messages), and debug logs associated with the malware's functional modules such as keylogging, credential stealing, file exfiltration, and system destructive capabilities like boot sector overwriting.
These YARA rules detect encrypted ZIP archive files that contain exactly one file. Specific variations are provided for ZIP files containing a single .vbs or .msc file. This pattern is commonly used in malware distribution via email to bypass static security controls, requiring user interaction to decrypt and execute the payload.
This rule detects obfuscation of the Windows Registry Run key paths (SOFTWARE\Microsoft\Windows\CurrentVersion\Run) through the insertion of arbitrary non-alphanumeric characters. This is a common evasion technique used to bypass simple string-based detections for persistent autostart registry entries.
This YARA rule detects the SugarWraith loader, a malware component identified by the presence of specific diagnostic strings, system enumeration artifacts, and indicators of persistence or configuration related to tunnel bypass tools like ngrok. It specifically targets Windows-based binaries that exhibit characteristics associated with the UNK_SweetSpector threat activity.
This YARA rule detects specific macOS malware components associated with the threat actor Citrine Sleet (AppleJeus) by matching static dylib and entitlement hashes. It targets identified malicious payloads including UpdateAgent, SimpleTea (POOLRAT), and CrashReporter to track the group's tooling.
INFO 3AM ransom
YARA
This YARA rule detects files containing specific strings and patterns associated with the 3AM ransomware, such as the group's name, their onion URL format, and common ransomware-related terminology. It is designed to identify ransom notes left behind on compromised systems.
ROOT GET PSHELL
YARA
No description available.
This YARA rule detects a specific Base64 decoding routine and associated hardcoded string patterns used by the Coyote Banking Trojan. The rule scans for bytecode sequences corresponding to .NET methods such as System.Text.Encoding::get_UTF8 and System.Convert::FromBase64String, which the malware uses to deobfuscate its malicious payloads or configuration components.
This YARA rule suite is designed to detect the Qbit Stealer malware and associated development artifacts. It uses specific string matches indicative of the stealer's configuration, logging, and functionality (such as file archiving and exfiltration) alongside development indicators like developer contact information and project metadata.
cipher wipe
YARA
This rule detects the use of the Windows 'cipher.exe' utility with the '/W' flag to wipe free disk space, invoked via a command shell (cmd.exe) within a PowerShell environment. This technique is often used by adversaries to prevent the forensic recovery of deleted files after they have been staged, modified, or exfiltrated, aligning with data destruction or anti-forensic activities.
Page 2 of 5