YARA · WithSecure Labs IOCs

WITHSECURELABS_Andariel_Gopherrat

Detects GopherRAT samples

GenericWithSecure Labs IOCsBSD 2-Clause LicenseCompiles with YARA-X

Author: WithSecure
Date: 2026-01-22
Score / Quality: 75 / 75

What this rule detects

Detects GopherRAT samples

Targets: Windows PE.

It defines 8 patterns (7 text, 1 hex, 0 regex). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

andariel-gopherrat.yarBSD 2-Clause License

import "pe"

rule WITHSECURELABS_Andariel_Gopherrat
{
	meta:
		description = "Detects GopherRAT samples"
		author = "WithSecure"
		id = "88627e61-43fa-5d5b-94f3-77d540131f90"
		date = "2026-01-22"
		modified = "2026-01-22"
		reference = "https://github.com/WithSecureLabs/iocs"
		source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L86-L105"
		license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
		logic_hash = "2a42590be19b4b9a258c63f683c724165d64cc7bf22e4b7e7dec3ff73ea9175c"
		score = 75
		quality = 75
		tags = ""

	strings:
		$cmdName1 = "GetMACHashID"
		$cmdName2 = "startHeartbeat"
		$cmdName3 = "encodeTo949"
		$cmdName4 = "xorDecrypt"
		$cmdName5 = "StartShell"
		$cmdName6 = "getLogicalDrives"
		$cmdName7 = "sendSocksCommand"
		$xorKey = {357095A221F033AC}

	condition:
		pe.is_pe and ( 3 of ( $cmdName* ) or $xorKey )
}

Strings (8 patterns)

Identifier	Type	Value
$cmdName1	text	"GetMACHashID"
$cmdName2	text	"startHeartbeat"
$cmdName3	text	"encodeTo949"
$cmdName4	text	"xorDecrypt"
$cmdName5	text	"StartShell"
$cmdName6	text	"getLogicalDrives"
$cmdName7	text	"sendSocksCommand"
$xorKey	hex	{357095A221F033AC}

Condition

pe.is_pe and ( 3 of ( $cmdName* ) or $xorKey )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
At least 3 patterns in ( $cmdName* ) must match.
Uses the pe module.
Pattern $xorKey must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/WithSecureLabs/iocs

Licence & attribution

Author: WithSecure

Source repository: WithSecure Labs IOCs @ 1a8384468d

Licence: BSD 2-Clause License (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 88627e61-43fa-5d5b-94f3-77d540131f90

WITHSECURELABS_Andariel_Jelusrat_PDB
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-01-22
WITHSECURELABS_Andariel_Jelusrat_Plugin
MalwareWithSecure Labs IOCs· WithSecure· 2026-01-22
WITHSECURELABS_Ducktail_Nativeaot
MalwareWithSecure Labs IOCs· WithSecure· 2022-11-17
WITHSECURELABS_Andariel_EDR_KILLER_Script
GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
WITHSECURELABS_Andariel_Portscanner_Versioninfo
GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
WITHSECURELABS_Andariel_Starshellrat
GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
WITHSECURELABS_Andariel_Undercrypt
GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
WITHSECURELABS_Andariel_Undercrypt_Versioninfo
GenericWithSecure Labs IOCs· WithSecure· 2026-01-22