YARA · Telekom Security malware analysis
TELEKOM_SECURITY_Win_Iceid_Core_Ldr_202104
2021 loader for Bokbot / Icedid core (license.dat)
- Author
- Thomas Barabosch, Telekom Security
- Date
- 2021-04-13
- Modified
- 2021-07-08
- Score / Quality
- 75 / 70
What this rule detects
2021 loader for Bokbot / Icedid core (license.dat)
Associated malware family: Iceid.
Targets: Windows PE.
It defines 10 patterns (10 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Telekom Security malware analysis, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: Thomas Barabosch, Telekom Security
Source repository: Telekom Security malware analysis @ 755efb6658
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: f096e18d-3a31-5236-b3c3-0df39b408d9a
Tags:FILE
Related rules
- TELEKOM_SECURITY_Win_Iceid_Core_202104Metadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-12
- MalwareditekSHen detection· ditekSHen· 2020-11-06
- TELEKOM_SECURITY_Crylock_BinaryMetadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-06-28
- TELEKOM_SECURITY_Crylock_HtaMetadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-06-28
- TELEKOM_SECURITY_Fake_Gzip_Bokbot_202104Metadata onlyGenericTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-20