YARA · RussianPanda
RUSSIANPANDA_Solarmarker_Loader_PS2EXE
Detects SolarMarker loader using PS2EXE
- Author
- RussianPanda
- Date
- 2024-01-04
- Score / Quality
- 75 / 85
What this rule detects
Detects SolarMarker loader using PS2EXE
Associated malware family: Solarmarker.
It defines 3 patterns (0 text, 3 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from RussianPanda, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- b45c31679c2516b38c7ff8c395f1d11d
Licence & attribution
Author: RussianPanda
Source repository: RussianPanda @ acb504b67b
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 837883a1-b657-52ae-95c4-ebafc8ac55de
Tags:FILE
Related rules
- RUSSIANPANDA_SolardropperMetadata onlyMalwareRussianPanda· RussianPanda· 2023-06-22
- RUSSIANPANDA_Solarmarker_LoaderMetadata onlyMalwareRussianPanda· RussianPanda· 2024-01-04
- RUSSIANPANDA_Solarmarker_First_Stage_PayloadMetadata onlyMalwareRussianPanda· RussianPanda· 2024-01-30
- MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-09
- MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-09
- MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-28
- MalwareditekSHen detection· ditekSHen· 2020-11-06
- Suspicious / huntingEmbee Research· Matthew @ Embee_Research· 2023-09-10