YARA · RussianPanda
RUSSIANPANDA_Win_Mal_Koi_Loader_Decrypted
Detects decrypted Koi Loader
- Author
- RussianPanda
- Date
- 2024-04-04
- Score / Quality
- 75 / 85
What this rule detects
Detects decrypted Koi Loader
Associated malware family: Koiloader.
Targets: Windows PE.
It defines 2 patterns (0 text, 2 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from RussianPanda, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 1901593e0299930d46b963866f33a93b
Licence & attribution
Author: RussianPanda
Source repository: RussianPanda @ acb504b67b
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 71de93d3-5c9f-5994-a54d-d4455d500280
Tags:FILE
Related rules
- RUSSIANPANDA_Win_Mal_Koi_LoaderMetadata onlyMalwareRussianPanda· RussianPanda· 2024-04-04
- MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20
- MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20
- MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20
- MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareCAPE Sandbox (CAPEv2)· YungBinary· 2024-10-25
- RUSSIANPANDA_SupperbackdoorMetadata onlyMalwareRussianPanda· RussianPanda· 2026-04-14