YARA rules tagged INKYSQUID

3 rules carry the tag “INKYSQUID”.

SIGNATURE_BASE_APT_MAL_Win_Bluelight
The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications.
APT / threat actorSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-04-23
SIGNATURE_BASE_APT_PY_Bluelight_Loader
Python Loader used to execute the BLUELIGHT malware family.
APT / threat actorSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-06-22
SIGNATURE_BASE_APT_MAL_Win_Decrok
The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload.
APT / threat actorSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-06-23