Skip to content
yararules.org
Menu

YARA · Arkbird SOLG (DailyIOC)

ARKBIRD_SOLG_MAL_Klingon_Jun_2021_1

Detect the Klingon RAT

MalwareArkbird SOLG (DailyIOC)No licence (all rights reserved)Compiles with YARA-X
Author
Arkbird_SOLG
Date
2021-06-19
Modified
2021-06-21
Score / Quality
75 / 75

What this rule detects

Detect the Klingon RAT

Targets: Windows PE.

It defines 3 patterns (0 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from Arkbird SOLG (DailyIOC), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHubOpen the repository

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611
  • c98bb0649262277ec9dd16cf27f8b06042ff552535995f2bdd3355d2adeff801
  • e8eea442e148c81f116de31b4fc3d0aa725c5dbbbd840b446a3fb9793d0b9f26

Licence & attribution

Author: Arkbird_SOLG

Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298

Licence: No licence (all rights reserved) (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: bf114c4d-3010-5b34-954e-82794e30edcb

Metadata

tlpWhite
adversary-

Tags:FILE

Related rules