YARA · WithSecure Labs IOCs

WITHSECURELABS_Andariel_Jelusrat_PDB

Detects JelusRAT packer and payload samples via PDB path

Suspicious / huntingJelus RatWithSecure Labs IOCsBSD 2-Clause LicenseCompiles with YARA-X

Author: WithSecure
Date: 2026-01-22
Score / Quality: 75 / 75

What this rule detects

Detects JelusRAT packer and payload samples via PDB path

Associated malware family: Jelus Rat.

Targets: Windows PE.

It defines 1 patterns (0 text, 0 hex, 1 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

andariel-jelusrat-pdb.yarBSD 2-Clause License

rule WITHSECURELABS_Andariel_Jelusrat_PDB : FILE
{
	meta:
		description = "Detects JelusRAT packer and payload samples via PDB path"
		author = "WithSecure"
		id = "1820e77e-818a-5de5-8483-84ec9448a58f"
		date = "2026-01-22"
		modified = "2026-01-22"
		reference = "https://github.com/WithSecureLabs/iocs"
		source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L125-L141"
		license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
		logic_hash = "a14d808ff783b7c42f3e4600386d578d63c88a0cd7c492cb1a026e0580b551f3"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$str_pdb = /jelus *rat[\x20-\x7F]{0,100}\.pdb\x00/ nocase

	condition:
		filesize <= 16MB and uint16( 0 ) == 0x5A4D and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

Strings (1 patterns)

Identifier	Type	Value	Modifiers
$str_pdb	regex	/jelus *rat[\x20-\x7F]{0,100}\.pdb\x00/	nocase

Condition

filesize <= 16MB and uint16( 0 ) == 0x5A4D and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 16MB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/WithSecureLabs/iocs

Licence & attribution

Author: WithSecure

Source repository: WithSecure Labs IOCs @ 1a8384468d

Licence: BSD 2-Clause License (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 1820e77e-818a-5de5-8483-84ec9448a58f

Tags:FILE

WITHSECURELABS_Andariel_Jelusrat_Plugin
MalwareWithSecure Labs IOCs· WithSecure· 2026-01-22
MALPEDIA_Win_Jelus_Rat_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
WITHSECURELABS_LOOKVALJS
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
WITHSECURELABS_LOOKVALPS
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
WITHSECURELABS_TEASOUP
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
WITHSECURELABS_DAYLIGHT
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
WITHSECURELABS_Tanglecrypt
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2025-11-25
WITHSECURELABS_Ducktail_Nativeaot
MalwareWithSecure Labs IOCs· WithSecure· 2022-11-17

More Jelus Rat rules