Skip to content
yararules.org
Menu

YARA · WithSecure Labs IOCs

WITHSECURELABS_Andariel_Undercrypt

Detects UnderCrypt samples based on shared code portions

GenericWithSecure Labs IOCsBSD 2-Clause LicenseCompiles with YARA-X
Author
WithSecure
Date
2026-01-22
Score / Quality
75 / 75

What this rule detects

Detects UnderCrypt samples based on shared code portions

It defines 5 patterns (0 text, 5 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
andariel-undercrypt.yarBSD 2-Clause License
rule WITHSECURELABS_Andariel_Undercrypt
{
	meta:
		description = "Detects UnderCrypt samples based on shared code portions"
		author = "WithSecure"
		id = "840d250f-7ad5-53df-aad9-20d405bf81bf"
		date = "2026-01-22"
		modified = "2026-01-22"
		reference = "https://github.com/WithSecureLabs/iocs"
		source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/Andariel2025/andariel.yara#L40-L53"
		license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
		logic_hash = "38ae107a8eeea3d54c34fa62fb8e8eb133489fc90337920c14319a2e7b51603a"
		score = 75
		quality = 75
		tags = ""

	strings:
		$1 = {C0746F4C8BDE498D1C024D2B5D304C3BD3735FBF00F0000041BE00A0000041833A00744E458B42044D8D4A084983E80849D1E84585C0742E90410FB71141FFC8}
		$2 = {00448B461C448B4E244C03C2448B56204C03CA4C03D2F7C50000FFFF752B8B4E100FB7D53BD17213034E143BD1730C0FB7C5418B1C804903DBEB6433C04881C4}
		$6 = {119C4000C04FA30A3E23672FCB3AABD2119C4000C04FA30A3E9EDB32D3B3B925418207A14884F532168D1880928E0E6748B30C7FA83884E8DED2D139BD2FBA6A4889B0B4B0CB466891DC96F605292B6336AD8BC4389CF2A7132205931904000000}
		$7 = {647265488D5424204863403C448BC366C744242C7373885C242E428B8C10880000004903CA448B49208B79244D03CA8B711C4903FA448B59144903F24585DB7441418B01B1474903C23A08750E0FB64A0148FFC248FFC084C975EE0FB608380A741341FFC0488D5424204983C104453BC3}
		$8 = {4C8BD0C745E04765745033D2C745E4726F63418BFA8855EE4863403C448BC2C745E864647265488D55E066C745EC7373428B8C10880000004903CA448B4920448B69244D03CA8B411C4D03EA448B59144903C2488945484585DB744C660F1F440000418B01B1474903C23A08750E0FB64A0148FFC248FF}

	condition:
		any of them
}

Strings (5 patterns)

IdentifierTypeValueModifiers
$1hex{C0746F4C8BDE498D1C024D2B5D304C3BD3735FBF00F0000041BE00A0000041833A00744E458B42044D8D4A084983E80849D1E84585C0742E90410FB71141FFC8}
$2hex{00448B461C448B4E244C03C2448B56204C03CA4C03D2F7C50000FFFF752B8B4E100FB7D53BD17213034E143BD1730C0FB7C5418B1C804903DBEB6433C04881C4}
$6hex{119C4000C04FA30A3E23672FCB3AABD2119C4000C04FA30A3E9EDB32D3B3B925418207A14884F532168D1880928E0E6748B30C7FA83884E8DED2D139BD2FBA6A4889B0B4B0CB466891DC96F605292B6 …
$7hex{647265488D5424204863403C448BC366C744242C7373885C242E428B8C10880000004903CA448B49208B79244D03CA8B711C4903FA448B59144903F24585DB7441418B01B1474903C23A08750E0FB64 …
$8hex{4C8BD0C745E04765745033D2C745E4726F63418BFA8855EE4863403C448BC2C745E864647265488D55E066C745EC7373428B8C10880000004903CA448B4920448B69244D03CA8B411C4D03EA448B591 …

Condition

any of them

In plain words (Heuristic)

  • At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: WithSecure

Source repository: WithSecure Labs IOCs @ 1a8384468d

Licence: BSD 2-Clause License (repository licence)

Copyright notice: Copyright (c) 2022, WithSecure Oyj

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 840d250f-7ad5-53df-aad9-20d405bf81bf

Related rules