YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_Information_Collector_May26

Detects reconaissance payload used in the DAEMON Tools supplychain compromise. The tools collects detailed information about the infected system like hardware, installed software, running processes etc. all data is exfilled to an attacker controlled server.

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: MalGamy, Jonathan Peters (cod3nym)
Date: 2026-05-05
Modified: 2026-05-15
Score / Quality: 80 / 85

What this rule detects

Targets: Windows PE.

It defines 6 patterns (4 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

mal-information-collector-may26.yarDetection Rule License 1.1

rule SIGNATURE_BASE_MAL_Information_Collector_May26 : FILE
{
	meta:
		description = "Detects reconaissance payload used in the DAEMON Tools supplychain compromise. The tools collects detailed information about the infected system like hardware, installed software, running processes etc. all data is exfilled to an attacker controlled server."
		author = "MalGamy, Jonathan Peters (cod3nym)"
		id = "97bfe7ef-ba23-550c-a6bf-412c759eec91"
		date = "2026-05-05"
		modified = "2026-05-15"
		reference = "https://securelist.com/tr/daemon-tools-backdoor/119654/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/threat_compromised_daemon_tools_lite_may26.yar#L1-L27"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "a916e56121212613d17932e124b68752c9312e73bde8f2351054bd64394257df"
		logic_hash = "fe05c931037eb62a78f4f696a2697b44672751538eadd37ff20379d9bdd4f013"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$x1 = ": InfoCollector.exe <" wide
		$s1 = "CollectInstalledSoftwareSemicolon" ascii
		$s2 = "GetRc4KeyFromUrl" ascii
		$s3 = "InfoGatherer" ascii
		$op1 = { 09 7E ?? ?? ?? 04 28 ?? ?? ?? 0A 28 ?? ?? ?? 0A 13 ?? 11 ?? 16 36 3A 11 ?? 1E 35 ?? 1E 8D ?? ?? ?? 01 13 ?? 09 7E ?? ?? ?? 04 28 ?? ?? ?? 0A 11 ?? 16 11 ?? 28 ?? ?? ?? 0A }
		$op2 = { 02 73 ?? ?? ?? 0A 6F ?? ?? ?? 0A 0A 06 2D ?? 72 ?? ?? ?? 70 0B DE ?? 06 6F ?? ?? ?? 0A 0A 06 72 ?? ?? ?? 70 7E ?? ?? ?? 0A 6F ?? ?? ?? 0A 0A 06 6F ?? ?? ?? 0A 2D ?? 72 ?? ?? ?? 70 0B DE ?? 06 0B DE }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and ( $x1 or all of ( $op* ) or all of ( $s* ) )
}

Strings (6 patterns)

Identifier	Type	Value	Modifiers
$x1	text	": InfoCollector.exe <"	wide
$s1	text	"CollectInstalledSoftwareSemicolon"	ascii
$s2	text	"GetRc4KeyFromUrl"	ascii
$s3	text	"InfoGatherer"	ascii
$op1	hex	{ 09 7E ?? ?? ?? 04 28 ?? ?? ?? 0A 28 ?? ?? ?? 0A 13 ?? 11 ?? 16 36 3A 11 ?? 1E 35 ?? 1E 8D ?? ?? ?? 01 13 ?? 09 7E ?? ?? ?? 04 28 ?? ?? ?? 0A 11 ?? 16 11 ?? 28 …
$op2	hex	{ 02 73 ?? ?? ?? 0A 6F ?? ?? ?? 0A 0A 06 2D ?? 72 ?? ?? ?? 70 0B DE ?? 06 6F ?? ?? ?? 0A 0A 06 72 ?? ?? ?? 70 7E ?? ?? ?? 0A 6F ?? ?? ?? 0A 0A 06 6F ?? ?? ?? 0A …

Condition

uint16( 0 ) == 0x5a4d and filesize < 50KB and ( $x1 or all of ( $op* ) or all of ( $s* ) )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 50KB (a cheap guard that skips large files).
All patterns in ( $op* ) must match.
All patterns in ( $s* ) must match.
Pattern $x1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://securelist.com/tr/daemon-tools-backdoor/119654/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

a916e56121212613d17932e124b68752c9312e73bde8f2351054bd64394257df

Licence & attribution

Author: MalGamy, Jonathan Peters (cod3nym)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 97bfe7ef-ba23-550c-a6bf-412c759eec91

Tags:FILE