YARA rules for Kwampirs
4 rules from 2 sources detect Kwampirs. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: APT / threat actor, Malware.
Family grouping is heuristic: check each rule's description.
Scan files with all Kwampirs rulesSearch rules
Kwampirs implant xor and rsa keys
APT / threat actorCostin Raiu yararules· FBI / cywatch@fbi.gov· 2020-01-14Kwampirs installer xor keys and Unicode string length routine
APT / threat actorCostin Raiu yararules· FBI / cywatch@fbi.gov· 2020-01-14Kwampirs and Shamoon common code
APT / threat actorCostin Raiu yararules· FBI / cywatch@fbi.gov· 2020-01-14autogenerated rule brought to you by yara-signator
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04