WithSecure Labs IOCs

Repository

https://github.com/WithSecureLabs/iocs

Commit

1a8384468dd292c6d2c5114c32e42dc0da1f5ae1

Retrieved

2026-09-27

Licence

BSD 2-Clause License

©

Copyright (c) 2022, WithSecure Oyj

Published

Full text

Why

BSD 2-Clause: redistribution allowed with the copyright notice and licence text retained.

Download pack (.yar, 24 rules)

BSD 2-Clause License

Copyright (c) [2022], [WithSecure Oyj]

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Rules from WithSecure Labs IOCs

• WITHSECURELABS_Andariel_Jelusrat_PDB

  Detects JelusRAT packer and payload samples via PDB path

  Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-01-22
• WITHSECURELABS_Andariel_Jelusrat_Plugin

  Detects JelusRAT plugins

  MalwareWithSecure Labs IOCs· WithSecure· 2026-01-22
• WITHSECURELABS_Ducktail_Nativeaot

  Detects NativeAOT variants of DUCKTAIL malware

  MalwareWithSecure Labs IOCs· WithSecure· 2022-11-17
• WITHSECURELABS_Andariel_EDR_KILLER_Script

  Detects strings found in EDR killer batch script

  GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
• WITHSECURELABS_Andariel_Gopherrat

  Detects GopherRAT samples

  GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
• WITHSECURELABS_Andariel_Portscanner_Versioninfo

  Detects custom port scanner based on file version info

  GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
• WITHSECURELABS_Andariel_Starshellrat

  Detects StarshellRAT samples

  GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
• WITHSECURELABS_Andariel_Undercrypt

  Detects UnderCrypt samples based on shared code portions

  GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
• WITHSECURELABS_Andariel_Undercrypt_Versioninfo

  Detects UnderCrypt samples based on version info

  GenericWithSecure Labs IOCs· WithSecure· 2026-01-22
• WITHSECURELABS_Fake_Vpn_Client_Hta

  Detects HTA files masqeurading as fake VPN clients

  GenericWithSecure Labs IOCs· WithSecure· 2026-08-26
• WITHSECURELABS_Fallspy

  Detects FallSpy Android malware

  MalwareWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_GREYVIBE_JSLOADER_1

  Detects common strings found across one of GREYVIBE's loaders (observed across PrincessClub and PhantomMail campaigns)

  GenericWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_GREYVIBE_JSLOADER_2

  Detects common strings found across one of GREYVIBE's loaders (observed in PhantomMail campaign)

  GenericWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_GREYVIBE_Phantomrelay_Watchdog

  Detects GREYVIBE's watchdog script for PhantomRelay

  GenericWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_Legionrelay_Client

  Detects LegionRelay client script

  GenericWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_LOOKVALJS

  Detects a common string found across samples obfuscated with LOOKVALJS

  Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_LOOKVALPS

  Detects common strings found across samples obfuscated with LOOKVALPS

  Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_Phantomrelay_Client

  Detects PhantomRelay client script

  GenericWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_Phantomrelay_Fingerprint

  Detects PhantomRelay's fingerprinting script

  GenericWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_TEASOUP

  Detects common strings found across samples obfuscated with TEASOUP

  Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_DAYLIGHT

  Detects common strings found across samples obfuscated with DAYLIGHT

  Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2026-05-28
• WITHSECURELABS_Ducktail_Artifacts

  Detects artifacts found in files associated to DUCKTAIL malware

  MalwareWithSecure Labs IOCs· WithSecure· 2022-07-18
• WITHSECURELABS_SILKLOADER

  Detects SILKLOADER samples

  GenericWithSecure Labs IOCs· WithSecure· 2023-03-15
• WITHSECURELABS_Tanglecrypt

  Detects samples packed with TangleCrypt

  Suspicious / huntingWithSecure Labs IOCs· WithSecure· 2025-11-25