YARA · RussianPanda
RUSSIANPANDA_Win_Mal_Koistealer_PS
Detects KoiStealer PowerShell script
- Author
- RussianPanda
- Date
- 2024-04-04
- Score / Quality
- 75 / 85
What this rule detects
Detects KoiStealer PowerShell script
It defines 2 patterns (2 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from RussianPanda, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 4f55be0b55ec67dfda42b88e9c743a2a
Licence & attribution
Author: RussianPanda
Source repository: RussianPanda @ acb504b67b
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 6dfdb39c-1b6a-5969-9c2d-e09869af6e0f
Related rules
- RUSSIANPANDA_SupperbackdoorMetadata onlyMalwareRussianPanda· RussianPanda· 2026-04-14
- RUSSIANPANDA_GetshellpluginMetadata onlyMalwareRussianPanda· RussianPanda· 2025-12-31
- RUSSIANPANDA_Win_Mal_AstarionratMetadata onlyMalwareRussianPanda· RussianPanda· 2025-02-14
- RUSSIANPANDA_Win_Mal_Stealc_V2Metadata onlyMalwareRussianPanda· RussianPanda· 2025-04-10
- RUSSIANPANDA_Win_Ransom_Lockbit5Metadata onlyMalwareRussianPanda· RussianPanda· 2025-09-15
- RUSSIANPANDA_DarkvncMetadata onlyMalwareRussianPanda· RussianPanda· 2024-01-15
- RUSSIANPANDA_Pikabot_1Metadata onlyMalwareRussianPanda· RussianPanda· 2024-01-02
- RUSSIANPANDA_RaccoonstealerMetadata onlyMalwareRussianPanda· RussianPanda· 2024-01-08