← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
yarex_APTMalware
WHITE resteex0 2022-01-22 Modified: 2022-04-27
7713
IOCs
HIGH VOLUME
yarex/APTMalware https://github.com/resteex0/yarex
clsidquvtohryara ruleset authoridentifieraptmalwareapt28rulenblockusestartdbcsbuffernbspnameithesauruswordnamespace3httpwdcecfchgigjgaddressaptmalwareapt21ainfbfdekmcugcldltuntuedbfazyxzedbfapathnewwindowaptmalwareapt1j5feq1ayljl8wk29gvuassocaptmalwareapt29b8b4b0bclosehandlematchlenfinishmsgfeedbackerrorcimagemanagergetimageccmdtargetgetdatap6gpav2getruntimeclassaptmalwareapt19enpivmrqsmmnmbivesahldvirevfailedctrlllookupctrlshiftrascii ctrlarule setvgkjbmcqvepmkjwihjw9shellmainthreadinitfirstfilesexcaliburfilemg1entrysocketconcurrencyshellaptmalwareapt30okbpsplcqtobyjf
Indicators of Compromise (2 / 7713 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 YARA URL domain hostname email
TYPEINDICATORDESCRIPTIONCREATED
email 20160815085327.c3847590023e@mail.mxfeed.org — 2022-01-22
email danil.sytnikov@uarpa.com — 2022-01-22
References (12)
↗ APT 30.yar ↗ Equation Group.yar ↗ Winnti.yar ↗ Energetic Bear.yar ↗ Dark Hotel.yar ↗ APT 19.yar ↗ APT 10.yar ↗ APT 29.yar ↗ APT 1.yar ↗ APT 21.yar ↗ Gorgon Group.yar ↗ APT 28.yar