YARA · Arkbird SOLG (DailyIOC)
ARKBIRD_SOLG_APT_APT34_RDAT_July_2021_1
Detect RDAT used by APT34
- Author
- Arkbird_SOLG
- Date
- 2021-07-15
- Modified
- 2021-07-16
- Score / Quality
- 75 / 75
What this rule detects
Detect RDAT used by APT34
Targets: Windows PE.
It defines 6 patterns (0 text, 6 hex, 0 regex).
YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Arkbird SOLG (DailyIOC), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- b59dea96ef94e8d32ee1a1805174318643569bbdca0d7569ede19467ff09dcdc
- 65a6afc027ff851bd325d8a4f2ab4f326dd8f2c230bfd49a213c5afc00df8e2c
- f9f6dbb09773f708b125a4cca509047eb33c8c53d9e15a8c41ae3d7a8c3e5c7c
Licence & attribution
Author: Arkbird_SOLG
Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 136f8a9e-e680-5fab-8113-b4d33a47bc34
Metadata
| tlp | White |
|---|---|
| adversary | APT34 |
Tags:FILE
Related rules
- ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-02-18
- ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-03-08
- ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-04-28
- ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
- ARKBIRD_SOLG_APT_Gelsemium_Gelsevirine_June_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
- ARKBIRD_SOLG_APT_Puzzlemaker_Implant_Jun_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-10
- ARKBIRD_SOLG_APT_Puzzlemaker_Launcher_Jun_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-10
- ARKBIRD_SOLG_APT_Tardigrade_Nov_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-22