YARA rules tagged CHARMINGCYPRESS
6 rules carry the tag “CHARMINGCYPRESS”.
VBS backdoor which bares architectural similarity to the POWERSTAR malware family.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-01-04Detects a fake OpenVPN client developed by CharmingCypress.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-10-17Detection for a .ovpn file used in a malicious VPN client on victim machines by CharmingCypress.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-10-17Detection for fake macOS VPN client used by CharmingCypress.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-10-17Detects POWERSTAR modules based on common HTTP functions used across modules.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-06-02Detects POWERLESS malware.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-10-25