YARA · WithSecure Labs IOCs

WITHSECURELABS_Tanglecrypt

Detects samples packed with TangleCrypt

Suspicious / huntingWithSecure Labs IOCsBSD 2-Clause LicenseCompiles with YARA-X (with warnings)

Author: WithSecure
Date: 2025-11-25
Modified: 2025-11-24
Score / Quality: 75 / 73

What this rule detects

Detects samples packed with TangleCrypt

Targets: Windows PE.

It defines 3 patterns (0 text, 3 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

tanglecrypt.yarBSD 2-Clause License

rule WITHSECURELABS_Tanglecrypt : FILE
{
	meta:
		description = "Detects samples packed with TangleCrypt"
		author = "WithSecure"
		id = "d208791a-5edf-5c79-87e2-78ed5023ece7"
		date = "2025-11-25"
		modified = "2025-11-24"
		reference = "https://labs.withsecure.com/publications/tanglecrypt"
		source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/TangleCrypt/TangleCrypt_YARA.yar#L1-L27"
		license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
		hash = "2936f5f3ff24f5bb42eace4ad2d64989b19dc6cd75d8f4ee83496ee6bdf169f6"
		hash = "fb3fc93dc627c7dfd8d95c1d66c2cb66caac92783b6d6eb33ac5b91647871ae6"
		logic_hash = "0d980d72e6ddcc9eedc5977bf895f358144f5720c2ca32266854497afad4a382"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1.0"

	strings:
		$str1 = { 43 61 6E 27 74 20 63 61 6C 6C 20 57 69 6E 41 50 49 20 66 75 6E 63 74 69 6F 6E }
		$opc_x64 = { 41 B8 D7 08 00 00 [0-10] ( E8 | FF 15 ) }
		$opc_x86 = { 68 D7 08 00 00 [0-10] ( E8 | FF 15 ) }

	condition:
		uint16( 0 ) == 0x5A4D and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $str* ) and ( #opc_x64 > 50 or #opc_x86 > 50 )
}

Strings (3 patterns)

Identifier	Type	Value
$str1	hex	{ 43 61 6E 27 74 20 63 61 6C 6C 20 57 69 6E 41 50 49 20 66 75 6E 63 74 69 6F 6E }
$opc_x64	hex	{ 41 B8 D7 08 00 00 [0-10] ( E8 \| FF 15 ) }
$opc_x86	hex	{ 68 D7 08 00 00 [0-10] ( E8 \| FF 15 ) }

Condition

uint16( 0 ) == 0x5A4D and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $str* ) and ( #opc_x64 > 50 or #opc_x86 > 50 )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
All patterns in ( $str* ) must match.
Pattern $opc_x64 must occur > 50 times.
Pattern $opc_x86 must occur > 50 times.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://labs.withsecure.com/publications/tanglecrypt

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

2936f5f3ff24f5bb42eace4ad2d64989b19dc6cd75d8f4ee83496ee6bdf169f6
fb3fc93dc627c7dfd8d95c1d66c2cb66caac92783b6d6eb33ac5b91647871ae6

Licence & attribution

Author: WithSecure

Source repository: WithSecure Labs IOCs @ 1a8384468d

Licence: BSD 2-Clause License (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: d208791a-5edf-5c79-87e2-78ed5023ece7

Metadata

version	1.0

Tags:FILE

WITHSECURELABS_Andariel_Jelusrat_PDB
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-01-22
WITHSECURELABS_LOOKVALJS
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
WITHSECURELABS_LOOKVALPS
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
WITHSECURELABS_TEASOUP
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
WITHSECURELABS_DAYLIGHT
Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
WITHSECURELABS_Andariel_Jelusrat_Plugin
MalwareWithSecure Labs IOCs· WithSecure· 2026-01-22
WITHSECURELABS_Ducktail_Nativeaot
MalwareWithSecure Labs IOCs· WithSecure· 2022-11-17
WITHSECURELABS_Andariel_EDR_KILLER_Script
GenericWithSecure Labs IOCs· WithSecure· 2026-01-22