YARA · RussianPanda
RUSSIANPANDA_Ducktail_Myrdpservice_Bot
Detects Ducktail myRdpService bot
- Author
- RussianPanda
- Date
- 2023-12-24
- Modified
- 2023-12-26
- Score / Quality
- 75 / 85
What this rule detects
Detects Ducktail myRdpService bot
Associated malware family: Ducktail.
Targets: Windows PE.
It defines 3 patterns (0 text, 3 hex, 0 regex). YARA modules used: pe.
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from RussianPanda, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: RussianPanda
Source repository: RussianPanda @ acb504b67b
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 50786786-a7db-5290-a363-6fda139a0343
Tags:FILE
Related rules
- RUSSIANPANDA_Ducktail_MainbotMetadata onlyMalwareRussianPanda· RussianPanda· 2023-12-24
- RUSSIANPANDA_DucktailMetadata onlyMalwareRussianPanda· RussianPanda· 2023-04-25
- MalwareSignature Base (Florian Roth / Nextron)· dr4k0nia· 2023-06-16
- MalwareWithSecure Labs IOCs· WithSecure· 2022-11-17
- MalwareditekSHen detection· ditekSHen· 2020-11-06
- MalwareWithSecure Labs IOCs· WithSecure· 2022-07-18
- RUSSIANPANDA_SupperbackdoorMetadata onlyMalwareRussianPanda· RussianPanda· 2026-04-14
- RUSSIANPANDA_GetshellpluginMetadata onlyMalwareRussianPanda· RussianPanda· 2025-12-31