YARA · RussianPanda
RUSSIANPANDA_Metastealer
Detects the old version of MetaStealer 11-2023
- Author
- RussianPanda
- Date
- 2023-11-16
- Modified
- 2023-12-30
- Score / Quality
- 75 / 85
What this rule detects
Detects the old version of MetaStealer 11-2023
Associated malware family: Metastealer.
Targets: Windows PE.
It defines 5 patterns (5 text, 0 hex, 0 regex). YARA modules used: pe.
YARA-X says: warning[non_bool_expr]: non-boolean expression used as boolean
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from RussianPanda, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: RussianPanda
Source repository: RussianPanda @ acb504b67b
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: c178630b-d188-5faf-86b3-436894241d77
Related rules
- RUSSIANPANDA_Metastealer_Core_PayloadMetadata onlyMalwareRussianPanda· RussianPanda· 2023-12-29
- RUSSIANPANDA_Metastealer_NET_Reactor_PackerMetadata onlySuspicious / huntingRussianPanda· RussianPanda· 2023-12-29
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareditekSHen detection· ditekSHen· 2020-11-06
- RUSSIANPANDA_SupperbackdoorMetadata onlyMalwareRussianPanda· RussianPanda· 2026-04-14
- RUSSIANPANDA_GetshellpluginMetadata onlyMalwareRussianPanda· RussianPanda· 2025-12-31
- RUSSIANPANDA_Win_Mal_AstarionratMetadata onlyMalwareRussianPanda· RussianPanda· 2025-02-14
- RUSSIANPANDA_Win_Mal_Stealc_V2Metadata onlyMalwareRussianPanda· RussianPanda· 2025-04-10