YARA rules tagged STORMBAMBOO
7 rules carry the tag “STORMBAMBOO”.
Detects Python script used by KPlayer to update, modified by attackers to download a malicious payload.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-07-21Detects DUSTPAN malware using API hashes used to resolve functions at runtime.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-08-17Detection for RELOADEXT, a Google Chrome extension malware.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-23Detect the RELOADEXT installer.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-23Detects the July 2023 POCOSTICK variant. These strings are only visible in memory after several rounds of shellcode decryption.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-07-24Detects the base version of GIMMICK written in .NET.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2020-03-16Detects the macOS port of the GIMMICK malware.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-10-18