YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_NET_Katz_Stealer_Loader_May25

Detects .NET based Katz stealer loader

MalwareKatz StealerSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Jonathan Peters (cod3nym)
Date: 2025-05-21
Modified: 2026-05-15
Score / Quality: 80 / 85

What this rule detects

Detects .NET based Katz stealer loader

Associated malware family: Katz Stealer.

It defines 7 patterns (6 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

mal-net-katz-stealer-loader-may25.yarDetection Rule License 1.1

rule SIGNATURE_BASE_MAL_NET_Katz_Stealer_Loader_May25
{
	meta:
		description = "Detects .NET based Katz stealer loader"
		author = "Jonathan Peters (cod3nym)"
		id = "c3d33818-66a1-51d9-9bcd-d8d255f96881"
		date = "2025-05-21"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_katz_stealer.yar#L68-L88"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "0df13fd42fb4a4374981474ea87895a3830eddcc7f3bd494e76acd604c4004f7"
		logic_hash = "1922520d8c34660a0afff2f552ef0d1c6ec093fb10a00816e0216f574b686221"
		score = 80
		quality = 85
		tags = ""

	strings:
		$x = "ExecutarMetodoVAI" ascii
		$s1 = "VirtualMachineDetector" ascii
		$s2 = "Wow64SetThreadContext_API" ascii
		$s3 = "nomedoarquivo" ascii
		$s4 = { 65 78 74 65 6E C3 A7 61 6F 00 }
		$s5 = "payloadBuffer" ascii
		$s6 = "caminhovbs" ascii

	condition:
		3 of ( $s* ) or $x
}

Strings (7 patterns)

Identifier	Type	Value	Modifiers
$x	text	"ExecutarMetodoVAI"	ascii
$s1	text	"VirtualMachineDetector"	ascii
$s2	text	"Wow64SetThreadContext_API"	ascii
$s3	text	"nomedoarquivo"	ascii
$s4	hex	{ 65 78 74 65 6E C3 A7 61 6F 00 }
$s5	text	"payloadBuffer"	ascii
$s6	text	"caminhovbs"	ascii

Condition

3 of ( $s* ) or $x

In plain words (Heuristic)

At least 3 patterns in ( $s* ) must match.
Pattern $x must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

0df13fd42fb4a4374981474ea87895a3830eddcc7f3bd494e76acd604c4004f7

Licence & attribution

Author: Jonathan Peters (cod3nym)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: c3d33818-66a1-51d9-9bcd-d8d255f96881

SIGNATURE_BASE_MAL_Katz_Stealer_May25
MalwareSignature Base (Florian Roth / Nextron)· MalGamy (Nextron Systems)· 2025-05-16
MALPEDIA_Win_Katz_Stealer_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SIGNATURE_BASE_MAL_NET_UAC_Bypass_May25
MalwareSignature Base (Florian Roth / Nextron)· Jonathan Peters (cod3nym)· 2025-05-21
SIGNATURE_BASE_APT_Virtualizor_Compromise_Payload_Aug26
APT / threat actorSignature Base (Florian Roth / Nextron)· Jonathan Peters (cod3nym)· 2026-08-31
SIGNATURE_BASE_HKTL_Redsun_Privilege_Escalation_Apr26
Hack toolSignature Base (Florian Roth / Nextron)· Jonathan Peters (cod3nym)· 2026-04-16
SIGNATURE_BASE_SUSP_Email_Redirection_Spoofing_Feb25
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Jonathan Peters (cod3nym)· 2025-02-20

More Katz Stealer rules