YARA · artifact-drop
ARTIFACTDROP_Go_Reflectiveloader_Decryption_Loop
Detects the specific Odd/Even decryption loop in a Go-based loader for Vidar
- Author
- Matthieu Gras
- Date
- 2025-12-17
- Modified
- 2025-12-18
- Score / Quality
- 75 / 80
What this rule detects
Detects the specific Odd/Even decryption loop in a Go-based loader for Vidar
Associated malware family: Vidar.
Targets: Windows PE.
It defines 2 patterns (1 text, 1 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from artifact-drop, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: Matthieu Gras
Source repository: artifact-drop @ d2bcbe820b
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 0e9de6a0-ccfc-542d-b68d-470caa32eaec
Tags:FILE
Related rules
- MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-10
- MalwareSEKOIA.IO Community· Sekoia.io· 2022-07-26
- MalwareditekSHen detection· ditekSHen· 2020-11-06
- RUSSIANPANDA_Vidar_DLL_EmbeddedMetadata onlyMalwareRussianPanda· RussianPanda· 2023-05-02