YARA · Arkbird SOLG (DailyIOC)

ARKBIRD_SOLG_APT_Sidewinder_NET_Loader_Aug_2020_1

Detected the NET loader used by SideWinder group (August 2020)

What this rule detects

Detected the NET loader used by SideWinder group (August 2020)

Associated malware family: Sidewinder.

Targets: Windows PE.

It defines 8 patterns (8 text, 0 hex, 0 regex). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

Author: Arkbird_SOLG

Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 7334a3b8-cd56-5820-a073-5bd22076644f

Tags:FILE

ARKBIRD_SOLG_APT_Sidewinder_Nov_2020_1Metadata only
APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-11-14
SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2020-08-24
SIGNATURE_BASE_APT_MAL_Sidewinder_Implant
APT / threat actorSignature Base (Florian Roth / Nextron)· AT&T Alien Labs· 2020-08-25
CLUSTER25_Sidewinder_Apt_Rtf_Cve_2017_0199Metadata only
APT / threat actorCluster25 (via Open-Source-YARA-rules)· Cluster25· 2021-09-09
MALPEDIA_Win_Sidewinder_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SEKOIA_Backdoor_Win_Sidewinder_Cobaltstrike_2022_09
MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-24
ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1Metadata only
APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-02-18
ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1Metadata only
APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-03-08