YARA · Frank Boldewin (R3c0nst)
R3C0NST_ATM_Malware_XFS_ALICE
Detects ATM Malware ALICE
- Author
- Frank Boldewin (@r3c0nst)
- Date
- 2020-01-09
- Modified
- 2020-08-17
- Score / Quality
- 75 / 90
What this rule detects
Detects ATM Malware ALICE
Targets: Windows PE.
It defines 9 patterns (6 text, 3 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Frank Boldewin (R3c0nst), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 6b2fac8331e4b3e108aa829b297347f686ade233b24d94d881dc4eff81b9eb30
Licence & attribution
Author: Frank Boldewin (@r3c0nst)
Source repository: Frank Boldewin (R3c0nst) @ 54e9e6899b
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 6132730c-4684-517a-b90d-98ed250e2cba
Tags:FILE
Related rules
- R3C0NST_StealbitMetadata onlyMalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2021-08-12
- R3C0NST_ATM_Malware_DispcashbrMetadata onlyMalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2020-02-27
- R3C0NST_ATM_Malware_LoupMetadata onlyMalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2020-08-17
- R3C0NST_Prolock_MalwareMetadata onlyMalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2020-05-17
- R3C0NST_UNC2891_SlapstickMetadata onlyMalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2022-03-30
- R3C0NST_UNC2891_WinghookMetadata onlyMalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2022-03-30
- R3C0NST_ATM_CINEO4060_BlackboxMetadata onlyMalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2021-05-25
- R3C0NST_ATM_Malware_PloutusiMetadata onlyMalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2021-03-03