YARA · Arkbird SOLG (DailyIOC)
ARKBIRD_SOLG_APT_Turla_Bigboss_Apr_2021_1
Detects new BigBoss implants (SilentMoon/GoldenSky)
- Author
- Arkbird_SOLG
- Date
- 2021-04-06
- Modified
- 2021-07-17
- Score / Quality
- 75 / 71
What this rule detects
Detects new BigBoss implants (SilentMoon/GoldenSky)
Targets: Windows PE.
It defines 8 patterns (2 text, 6 hex, 0 regex).
YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Arkbird SOLG (DailyIOC), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 94421ccb97b784c43d92c4b1438481eee9c907db6b13f6cfc4b86a6bb057ddcd
- 67bfa585ace8df20deb1d8a05bd4acf2c84c6fa0966276b3ea7607056abe25bb
- 6ca0b4efe077fe05b2ae871bf50133c706c7090a54d2c3536a6c86ff454caa9a
Licence & attribution
Author: Arkbird_SOLG
Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 6f6c8d1e-f2c7-5f08-b1dc-ce726c6d89be
Tags:FILE
Related rules
- ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-02-18
- ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-03-08
- ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-04-28
- ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
- ARKBIRD_SOLG_APT_Gelsemium_Gelsevirine_June_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
- ARKBIRD_SOLG_APT_Puzzlemaker_Implant_Jun_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-10
- ARKBIRD_SOLG_APT_Puzzlemaker_Launcher_Jun_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-10
- ARKBIRD_SOLG_APT_Tardigrade_Nov_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-22