Skip to content
yararules.org
Menu

YARA rules for Earthworm

3 rules from 3 sources detect Earthworm. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: Malware, Hack tool.

Family grouping is heuristic: check each rule's description.

Scan files with all Earthworm rulesSearch rules

  • SIGNATURE_BASE_MAL_Earthworm_Socks_Proxy_ID_Generation

    Detects EarthWorm - a reverse socks proxy used by the threat group that deployed Pygmy Goat malware on Sophos XG firewall devices. The detection is based on the pool num generation x86 assembly.

    MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2024-10-22
  • SEKOIA_Hacktool_Earthworm_Strings

    Detects Mac/Win/Linux EarthWorm based on strings

    Hack toolSEKOIA.IO Community· Sekoia.io· 2022-02-08
  • MALPEDIA_Win_Earthworm_Auto

    autogenerated rule brought to you by yara-signator

    MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04