Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_Virtualizor_Compromise_Forensicartifacts_Aug26

Detects forensic artifacts found in a campaign against compromised hosting providers using Virtualizor software

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Florian Roth
Date
2026-08-31
Score / Quality
75 / 85

What this rule detects

Detects forensic artifacts found in a campaign against compromised hosting providers using Virtualizor software

It defines 6 patterns (6 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
apt-virtualizor-compromise-forensicartifacts-aug26.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_Virtualizor_Compromise_Forensicartifacts_Aug26 : FILE
{
	meta:
		description = "Detects forensic artifacts found in a campaign against compromised hosting providers using Virtualizor software"
		author = "Florian Roth"
		id = "4467e563-9652-50f7-9de9-ca788acca042"
		date = "2026-08-31"
		modified = "2026-08-31"
		reference = "https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_virtualizor_compromise_aug26.yar#L1-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "2a8821419395a11f1f86ef8324e881a4c8250832e65295dcdfe992b6cc33b363"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "AAAAC3NzaC1lZDI1NTE5AAAAIP13pPAm5jmInLQYD3XNb3HwrW4cAKDcphoT4kSKrnte"
		$x2 = "/tmp/.vz_svc_done"
		$x3 = "/tmp/widdow.jar"
		$x4 = "31.77.220.138:2025"
		$sa1 = "proxyuser"
		$sb1 = "193.32.127.248"

	condition:
		filesize < 5MB and ( 1 of ( $x* ) or all of ( $s* ) )
}

Strings (6 patterns)

IdentifierTypeValueModifiers
$x1text"AAAAC3NzaC1lZDI1NTE5AAAAIP13pPAm5jmInLQYD3XNb3HwrW4cAKDcphoT4kSKrnte"
$x2text"/tmp/.vz_svc_done"
$x3text"/tmp/widdow.jar"
$x4text"31.77.220.138:2025"
$sa1text"proxyuser"
$sb1text"193.32.127.248"

Condition

filesize < 5MB and ( 1 of ( $x* ) or all of ( $s* ) )

In plain words (Heuristic)

  • The file must be smaller than 5MB (a cheap guard that skips large files).
  • All patterns in ( $s* ) must match.
  • At least 1 patterns in ( $x* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Florian Roth

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 4467e563-9652-50f7-9de9-ca788acca042

Tags:FILE

Related rules