YARA · Volexity threat-intel

VOLEXITY_Apt_Malware_Win_Rokload

A shellcode loader used to decrypt and run an embedded executable.

APT / threat actorVolexity threat-intelBSD 2-Clause LicenseCompiles with YARA-X

Author: threatintel@volexity.com
Date: 2021-06-23
Modified: 2025-05-21
Score / Quality: 75 / 80

What this rule detects

A shellcode loader used to decrypt and run an embedded executable.

It defines 1 patterns (0 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-malware-win-rokload.yarBSD 2-Clause License

rule VOLEXITY_Apt_Malware_Win_Rokload : INKYPINE FILE
{
	meta:
		description = "A shellcode loader used to decrypt and run an embedded executable."
		author = "threatintel@volexity.com"
		id = "229dbf3c-1538-5ecd-b5f8-8c9a9c81c515"
		date = "2021-06-23"
		modified = "2025-05-21"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L91-L112"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904"
		logic_hash = "8d65d32fd5bc055ca0e3831d3db88299e7c99f8547a170d3c53ec2c4001496a3"
		score = 75
		quality = 80
		tags = "INKYPINE, FILE"
		os = "win"
		os_arch = "x64"
		scan_context = "file"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5603
		version = 4

	strings:
		$bytes00 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 57 41 54 41 55 41 56 41 57 48 ?? ?? ?? b9 ?? ?? ?? ?? 33 ff e8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 4c 8b e8 e8 ?? ?? ?? ?? 4c 8b f0 41 ff d6 b9 ?? ?? ?? ?? 44 8b f8 e8 ?? ?? ?? ?? 4c 8b e0 e8 ?? ?? ?? ?? 48 }

	condition:
		$bytes00 at 0
}

Strings (1 patterns)

Identifier	Type	Value	Modifiers
$bytes00	hex	{ 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 57 41 54 41 55 41 56 41 57 48 ?? ?? ?? b9 ?? ?? ?? ?? 33 ff e8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 4c 8b e8 e8 ?? ?? ?? ?? …

Condition

$bytes00 at 0

In plain words (Heuristic)

Pattern $bytes00 must be found at offset 0.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/volexity/threat-intel

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904

Licence & attribution

Author: threatintel@volexity.com

Source repository: Volexity threat-intel @ 3a9d0b5245

Licence: BSD 2-Clause License (stated in the rule's own meta)

“See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 229dbf3c-1538-5ecd-b5f8-8c9a9c81c515

Metadata

os	win
os_arch	x64
scan_context	file
severity	high
rule_id	5603
version	4

Tags:INKYPINE FILE

VOLEXITY_Apt_Malware_Py_Bluelight_Ldr
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-22
VOLEXITY_Apt_Malware_Rb_Rokrat_Loader
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-22
VOLEXITY_Apt_Malware_Win_Bluelight
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-04-23
VOLEXITY_Apt_Malware_Win_Decrok
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-23
VOLEXITY_Apt_Malware_Win_Deepdata_Module
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-07-30
VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-07-21
VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-08-17
VOLEXITY_Apt_Win_Iconicstealer
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-03-30