YARA rules for Exaramel
11 rules from 3 sources detect Exaramel. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: APT / threat actor, Malware.
Family grouping is heuristic: check each rule's description.
Scan files with all Exaramel rulesSearch rules
Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]
APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects contents of the configuration file used by Exaramel (plaintext)
APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]
APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]
APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects path of the unix socket created to prevent concurrent executions in Exaramel malware
APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects Strings used by Exaramel malware
APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO (composed from 4 saparate rules by Florian R…· 2021-02-15Detects misc strings in Exaramel malware with typos
APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects the beginning of type _type struct for some of the most important structs in Exaramel malware
APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects names of the tasks received from the CC server in Exaramel malware
APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15autogenerated rule brought to you by yara-signator
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04Exaramel Windows/Linux backdoor payload
MalwareditekSHen detection· ditekSHen· 2020-11-06