YARA · Arkbird SOLG (DailyIOC)
ARKBIRD_SOLG_SP_Vault7_SIG_F_Nov_2020_1
Detect open-source PasswordReminder recovery tools used by Chinese APT in the Past
- Author
- Arkbird_SOLG
- Date
- 2020-11-30
- Score / Quality
- 75 / 75
What this rule detects
Detect open-source PasswordReminder recovery tools used by Chinese APT in the Past
Targets: Windows PE.
It defines 9 patterns (0 text, 9 hex, 0 regex).
YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Arkbird SOLG (DailyIOC), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- e6e17f2b2ce0ae07cf48654156b79ee90d330961456f731e84c94f50fe34f802
- c224ee5bef42a45e84e0d5a409d8b4c3842b2a7ac3fe5006ee795e64e0778e6e
Licence & attribution
Author: Arkbird_SOLG
Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 0b65e333-16e2-57c3-84f0-5cd24c9d9593
Tags:FILE
Related rules
- ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-02-18
- ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-03-08
- ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-04-28
- ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
- ARKBIRD_SOLG_APT_Gelsemium_Gelsevirine_June_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
- ARKBIRD_SOLG_APT_Puzzlemaker_Implant_Jun_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-10
- ARKBIRD_SOLG_APT_Puzzlemaker_Launcher_Jun_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-10
- ARKBIRD_SOLG_APT_Tardigrade_Nov_2021_1Metadata onlyAPT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-22