Frank Boldewin (R3c0nst)

Repository

https://github.com/fboldewin/YARA-rules

Commit

54e9e6899b258b72074b2b4db6909257683240c2

Retrieved

2026-09-27

Licence

No licence (all rights reserved)

Published

Metadata

Why

No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.

Rules from Frank Boldewin (R3c0nst)

• R3C0NST_StealbitMetadata only

  Detects Stealbit used by Lockbit 2.0 Ransomware Gang

  MalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2021-08-12
• R3C0NST_ATM_Malware_DispcashbrMetadata only

  Detects ATM Malware DispCashBR

  MalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2020-02-27
• R3C0NST_ATM_Malware_LoupMetadata only

  Detects ATM Malware Loup

  MalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2020-08-17
• R3C0NST_Prolock_MalwareMetadata only

  Detects Prolock malware in encrypted and decrypted mode

  MalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2020-05-17
• R3C0NST_UNC2891_SlapstickMetadata only

  Detects UNC2891 Slapstick pam backdoor

  MalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2022-03-30
• R3C0NST_UNC2891_SteelcorgiMetadata only

  Detects UNC2891 Steelcorgi packed ELF binaries

  Suspicious / huntingFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2022-03-30
• R3C0NST_UNC2891_WinghookMetadata only

  Detects UNC2891 Winghook Keylogger

  MalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2022-03-30
• R3C0NST_Aplib_DecompressionMetadata only

  Detects aPLib decompression code often used in malware

  MalwareFrank Boldewin (R3c0nst)· @r3c0nst· 2021-03-24
• R3C0NST_Gamaredon_GetimportbyhashMetadata only

  Detects Gamaredon APIHashing

  GenericFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2021-05-12
• R3C0NST_Shellcode_Apihashing_FIN8Metadata only

  Detects FIN8 Shellcode APIHashing

  GenericFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2021-03-16
• R3C0NST_ATM_Malware_XFS_ALICEMetadata only

  Detects ATM Malware ALICE

  MalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2020-01-09
• R3C0NST_UNC2891_CaketapMetadata only

  Detects UNC2891 Rootkit Caketap

  GenericFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2022-03-30
• R3C0NST_Exploit_Outlook_CVE_2023_23397Metadata only

  Detects Outlook appointments exploiting CVE-2023-23397

  ExploitFrank Boldewin (R3c0nst)· Frank Boldewin· 2023-03-19
• R3C0NST_Nighthawk_RATMetadata only

  Detects Nighthawk RAT

  Hack toolFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2022-11-30
• R3C0NST_ATM_CINEO4060_BlackboxMetadata only

  Detects Malware samples for Diebold Nixdorf CINEO 4060 ATMs used in blackboxing attacks across Europe since May 2021

  MalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2021-05-25
• R3C0NST_ATM_Malware_PloutusiMetadata only

  Detects Ploutus I .NET samples based on MetabaseQ report

  MalwareFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2021-03-03