YARA rules for Ducktail
7 rules from 4 sources detect Ducktail. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: Malware.
Family grouping is heuristic: check each rule's description.
Scan files with all Ducktail rulesSearch rules
Detects binaries signed with compromised certificates used by DuckTail stealer - identified in June 2023
MalwareSignature Base (Florian Roth / Nextron)· dr4k0nia· 2023-06-16Detects NativeAOT variants of DUCKTAIL malware
MalwareWithSecure Labs IOCs· WithSecure· 2022-11-17Detects DuckTail
MalwareditekSHen detection· ditekSHen· 2020-11-06Detects artifacts found in files associated to DUCKTAIL malware
MalwareWithSecure Labs IOCs· WithSecure· 2022-07-18- RUSSIANPANDA_Ducktail_MainbotMetadata only
Detects Ducktail mainbot
MalwareRussianPanda· RussianPanda· 2023-12-24 - RUSSIANPANDA_Ducktail_Myrdpservice_BotMetadata only
Detects Ducktail myRdpService bot
MalwareRussianPanda· RussianPanda· 2023-12-24 - RUSSIANPANDA_DucktailMetadata only
Ducktail Infostealer
MalwareRussianPanda· RussianPanda· 2023-04-25