YARA · Telekom Security malware analysis
TELEKOM_SECURITY_Win_Iceid_Core_202104
2021 Bokbot / Icedid core
- Author
- Thomas Barabosch, Telekom Security
- Date
- 2021-04-12
- Modified
- 2021-07-08
- Score / Quality
- 75 / 70
What this rule detects
2021 Bokbot / Icedid core
Associated malware family: Iceid.
Targets: Windows PE.
It defines 12 patterns (12 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Telekom Security malware analysis, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: Thomas Barabosch, Telekom Security
Source repository: Telekom Security malware analysis @ 755efb6658
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 526a73da-415f-58fe-bb5f-4c3df6b2e647
Tags:FILE
Related rules
- TELEKOM_SECURITY_Win_Iceid_Core_Ldr_202104Metadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-13
- MalwareditekSHen detection· ditekSHen· 2020-11-06
- TELEKOM_SECURITY_Crylock_BinaryMetadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-06-28
- TELEKOM_SECURITY_Crylock_HtaMetadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-06-28
- TELEKOM_SECURITY_Fake_Gzip_Bokbot_202104Metadata onlyGenericTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-20