YARA rules for Lookback
6 rules from 2 sources detect Lookback. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: APT / threat actor, Malware.
Family grouping is heuristic: check each rule's description.
Scan files with all Lookback rulesSearch rules
Matches encryption/decryption function used by LookBack.
APT / threat actorESET malware-ioc· ESET Research· 2021-10-12Matches LookBack's hardcoded HTTP request
APT / threat actorESET malware-ioc· ESET Research· 2021-10-12Matches the modified function in LookBack libcurl loader.
APT / threat actorESET malware-ioc· ESET Research· 2021-10-12Matches message header creation in LookBack.
APT / threat actorESET malware-ioc· ESET Research· 2021-10-12Matches multiple strings and export names in TA410 LookBack.
APT / threat actorESET malware-ioc· ESET Research· 2021-10-12autogenerated rule brought to you by yara-signator
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04