Reglas YARA para Kimsuky

Detects FPSpy, a backdoor used by Kimsuky

Detects KLogExe, a keylogger used by Kimsuky

Powershell scripts used by Kimsuky. If size < 3KB ok. If between 3 and 15, a check is needed

Detects a PowerShell dropper used by Kimsuky

Detects obfuscated version of Kimsuky TODDLERSHARK vbs malware

Detects Kimsuky TODDLERSHARK vbs malware

Detects Kimsuky validator

VBS files used by Kimsuky

Detect Kimsuky LNK

Detects malicious LNK used by Kimsuky

Detects malicious VBA used by Kimsuky

Detects compromised Chrome SecurePreferences file

Detects the DevTool module used by SharpExt

Detects the exfiltration JS code of SharpExt

Detects the PHP code of the SharpTongue C2

Detects SharpTongue variants.

Detects VBS Launchers used by SharpTongue

Detects VBS/Powershell Downloader used by Kimsuky

Rule based on structure offset and file extension

autogenerated rule brought to you by yara-signator

Detects Kimsuky backdoor

Detect the backdoors used by Kimsuky based on specific PE ressources

Detect the GoBear backdoor used by Kimsuky

Detect Gold Dragon used by Kimsuky APT group