Règles YARA avec le tag INKYSQUID

3 règles portent le tag « INKYSQUID ».

SIGNATURE_BASE_APT_MAL_Win_Bluelight
The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications.
APT / acteurSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-04-23
SIGNATURE_BASE_APT_PY_Bluelight_Loader
Python Loader used to execute the BLUELIGHT malware family.
APT / acteurSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-06-22
SIGNATURE_BASE_APT_MAL_Win_Decrok
The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload.
APT / acteurSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-06-23