Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Katz_Log_May25

Detects log file that contains system reconnaissance data, seen being generated by Katz stealer

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
MalGamy
Date
2025-05-20
Modified
2026-05-15
Score / Quality
65 / 85

What this rule detects

Detects log file that contains system reconnaissance data, seen being generated by Katz stealer

It defines 4 patterns (4 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-katz-log-may25.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_Katz_Log_May25 : FILE
{
	meta:
		description = "Detects log file that contains system reconnaissance data, seen being generated by Katz stealer"
		author = "MalGamy"
		id = "be56f0ae-e444-569e-95d7-edccf4c6dd2b"
		date = "2025-05-20"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_katz_stealer.yar#L45-L66"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "1ac196ac6393d786618c944a7ab77fb189a6b4ba00af5c0f987c3dc65876c060"
		hash = "ad76e2727469525dec7e56977589dd250ca57a29b8b0d42cd5c42e536c285241"
		hash = "e1a0d6929662bcbc9e5e0827cb8b6d7818088e996cf971d2a4a1c1ca4208e533"
		hash = "b10796c41e1cec7c84a3c68bfcaa7b20f49b620d1c94304a6b3ed73471fa9031"
		hash = "5a984e2e308fe84e4e2071dd877772361719ba0217c2c23da79dbb82dc15eac8"
		logic_hash = "847ab8f9a7abf260f4185d41ae9cb9af40c28726338ff2306a75d2160ae61f03"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "Motherboard Manufacturer:" ascii
		$s2 = "===== System Information =====" ascii
		$s3 = "Volume Name:" ascii
		$s4 = "Desktop Hostname:" ascii

	condition:
		filesize < 50KB and 3 of them
}

Strings (4 patterns)

IdentifierTypeValueModifiers
$s1text"Motherboard Manufacturer:"ascii
$s2text"===== System Information ====="ascii
$s3text"Volume Name:"ascii
$s4text"Desktop Hostname:"ascii

Condition

filesize < 50KB and 3 of them

In plain words (Heuristic)

  • The file must be smaller than 50KB (a cheap guard that skips large files).
  • At least 3 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 1ac196ac6393d786618c944a7ab77fb189a6b4ba00af5c0f987c3dc65876c060
  • ad76e2727469525dec7e56977589dd250ca57a29b8b0d42cd5c42e536c285241
  • e1a0d6929662bcbc9e5e0827cb8b6d7818088e996cf971d2a4a1c1ca4208e533
  • b10796c41e1cec7c84a3c68bfcaa7b20f49b620d1c94304a6b3ed73471fa9031
  • 5a984e2e308fe84e4e2071dd877772361719ba0217c2c23da79dbb82dc15eac8

Licence & attribution

Author: MalGamy

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: be56f0ae-e444-569e-95d7-edccf4c6dd2b

Tags:FILE

Related rules