YARA · BlackBerry Research & Intelligence (via Open-Source-YARA-rules)

BLACKBERRY_Mal_Backdoor_Chachi_RAT

ChaChi RAT used in PYSA Ransomware Campaigns

Author: BlackBerry Threat Research & Intelligence
Date: 2022-07-07
Score / Quality: 75 / 77

What this rule detects

ChaChi RAT used in PYSA Ransomware Campaigns

Targets: Windows PE.

It defines 4 patterns (0 text, 4 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from BlackBerry Research & Intelligence (via Open-Source-YARA-rules), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHub Open the repository

References

https://blogs.blackberry.com/en/2021/06/pysa-loves-chachi-a-new-golang-rat

Licence & attribution

Author: BlackBerry Threat Research & Intelligence

Source repository: BlackBerry Research & Intelligence (via Open-Source-YARA-rules) @ ec0056f767

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: f0d531d3-585a-5194-ac30-fc62433d0ffc

Tags:FILE