YARA · Arkbird SOLG (DailyIOC)

ARKBIRD_SOLG_APT_MAL_Donot_Loader_June_2020_1

Detect loader malware used by APT Donot for drops the final stage

What this rule detects

Detect loader malware used by APT Donot for drops the final stage

Associated malware family: Donot.

Targets: Windows PE.

It defines 9 patterns (9 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

Author: Arkbird_SOLG

Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: ec4cac12-529f-56d2-bbc0-5fe30424b10b

Tags:FILE

ARKBIRD_SOLG_APT_Donot_Downloader_May_2021_1Metadata only
APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-05-09
SEKOIA_Downloader_Win_Donot
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-20
SEKOIA_Keylogger_Win_Donot
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-20
MALPEDIA_Win_Donot_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1Metadata only
APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-02-18
ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1Metadata only
APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-03-08
ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1Metadata only
APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-04-28
ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1Metadata only
APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12