YARA rules tagged BRAZENBAMBOO

3 rules carry the tag “BRAZENBAMBOO”.

VOLEXITY_Apt_Malware_Win_Deepdata_Module
Detects modules used by DEEPDATA based on the required export names used by those modules.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-07-30
VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_C2_Strings
Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-15
VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_Core
Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-15