WITHSECURELABS_Phantomrelay_Client

rule WITHSECURELABS_Phantomrelay_Client : FILE
{
	meta:
		description = "Detects PhantomRelay client script"
		author = "WithSecure"
		id = "d65c65a3-beab-51cd-8700-1204ce40791e"
		date = "2026-05-28"
		modified = "2026-05-28"
		reference = "https://github.com/WithSecureLabs/iocs"
		source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L141-L153"
		license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
		logic_hash = "3d5ad744d1689b71604d55ec75a971f1a1f89c3f030c069a5ea205e4a3e4fac4"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$a = ".idc"
		$b = ".cmd"
		$c = ".psh"
		$d = "WebSockets.ClientWebSocket"

	condition:
		filesize < 100KB and all of them
}