YARA rules for Winnti
8 rules from 3 sources detect Winnti. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: APT / threat actor, Malware, Hack tool.
Family grouping is heuristic: check each rule's description.
Scan files with all Winnti rulesSearch rules
matches the Winnti 'Cooper' loader version used for the RedMimicry breach emulation
Hack toolSignature Base (Florian Roth / Nextron)· mirar@chaosmail.org· 2020-06-22Detects Winnti malware
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06Detects Winnti malware
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06Detects Winnti malware
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06Detects Winnti malware
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06Detects Winnti malware
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06autogenerated rule brought to you by yara-signator
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04Detects Winnti variants
APT / threat actorTrellix Advanced Research Center· McAfee ATR Team· 2020-06-04