Skip to content

Instantly share code, notes, and snippets.

@nikolay-n
Last active January 19, 2023 22:41
Show Gist options
  • Save nikolay-n/854953f84b3d3cef4c3736e49fdfa4cd to your computer and use it in GitHub Desktop.
Save nikolay-n/854953f84b3d3cef4c3736e49fdfa4cd to your computer and use it in GitHub Desktop.
XProtect.yara demystified
Rule ID Malware Name Add Mod Virustotal Hybrid Analysis ObjSee VirusShare
AbkA AoboKeylogger, AoboKey, AoboKeyLog 2081 2016-07-06 2136 2020-11-20 πŸ”—
AdPluginA Yontoo 2081 2016-07-06 2136 2020-11-20 πŸ”—
AdPluginB VSearch, Chatzum, Zako 2081 2016-07-06 2136 2020-11-20 πŸ”—
BundloreA 2081 2016-07-06 2081 2016-07-06
CoinThiefA CoinThief, CoinStealer, StealBit 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”—
CoinThiefB CoinThief, CoinStealer, StealBit 2081 2016-07-06 2081 2016-07-06 πŸ”—
CoinThiefC CoinThief, CoinStealer, StealBit 2081 2016-07-06 2136 2020-11-20 πŸ”—
CrossRiderA 2081 2016-07-06 2081 2016-07-06
DevilRobberA 2081 2016-07-06 2136 2020-11-20
DevilRobberB 2081 2016-07-06 2136 2020-11-20
EICAR EICAR_Test_File 2081 2016-07-06 2136 2020-11-20 πŸ”—
EleanorA Eleanor 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”— πŸ”—
FileStealA 2081 2016-07-06 2136 2020-11-20
FileStealB FileSteal, Kitmos, HackBack 2081 2016-07-06 2081 2016-07-06 πŸ”—
FkCodecA 2081 2016-07-06 2081 2016-07-06
FlashbackA FlashBack, Flashfake 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”—
FlashbackB FlashBack, Flashfake 2081 2016-07-06 2081 2016-07-06 πŸ”—
FlashbackC FlashBack, Flashfake 2081 2016-07-06 2081 2016-07-06 πŸ”—
GenieoA Genieo 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”—
GenieoB Genieo 2081 2016-07-06 2081 2016-07-06 πŸ”—
GenieoC Genieo 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”—
GenieoD Genieo 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”—
GenieoDropper 2081 2016-07-06 2081 2016-07-06
GenieoE Genieo 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”—
GetShellA GetShell, Siggen 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”—
HellRTS 2081 2016-07-06 2103 2019-05-01
HMining Genieo, HMining 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”—
HMining_Binary_A Genieo, HMining 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”—
InstallCoreA InstallCore, InstallMiez 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”— πŸ”—
InstallImitatorA InstallCore, InstallMiez, InstallImitator 2081 2016-07-06 2136 2020-11-20 πŸ”—
InstallImitatorB 2081 2016-07-06 2081 2016-07-06
InstallImitatorC VSearch,Dypti 2081 2016-07-06 2081 2016-07-06 πŸ”—
IServiceA iWorm, Iservice, Krowi 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”— πŸ”—
IWormA iWorm, Iservice 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”— πŸ”—
IWormBC 2081 2016-07-06 2136 2020-11-20
KeRangerA KeRanger 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”— πŸ”—
LaoShuA LaoShu 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”— πŸ”—
LeverageA Leverage, Seadoor 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”— πŸ”—
MacDefenderA MacDefender, FakeAlert, FakeAV, Defma 2081 2016-07-06 2136 2020-11-20 πŸ”—n πŸ”— πŸ”—
MacDefenderB 2081 2016-07-06 2136 2020-11-20
MachookA WireLurker, MAChook 2081 2016-07-06 2136 2020-11-20 πŸ”—
MachookB WireLurker, MAChook 2081 2016-07-06 2136 2020-11-20 πŸ”—
MaControlA MacContro, MacKontrol, Longage 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”— πŸ”—
MDropperA 2081 2016-07-06 2136 2020-11-20
NetWeirdA Wirenet, Netweird 2081 2016-07-06 2081 2016-07-06 πŸ”—
NetWeirdB 2081 2016-07-06 2136 2020-11-20
OpinionSpyA OpinionSpy, Spynion 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”— πŸ”—
OpinionSpyB OpinionSpy, Spynion 2081 2016-07-06 2136 2020-11-20 πŸ”—
PrxlA 2081 2016-07-06 2136 2020-11-20
QHostWBA QHost, Malcol 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”— πŸ”—
RevirA Revir 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”— πŸ”—
RevirB Revir, Imuler 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”— πŸ”—
RevirC 2081 2016-07-06 2136 2020-11-20
RevirD Revir, Imuler 2081 2016-07-06 2081 2016-07-06 πŸ”—
RSPlugA DNSChanger, Jahlav, RSPlug, Puper 2081 2016-07-06 2136 2020-11-20 πŸ”—
SMSSendA SMSsend, Archsms, Zonsterarch 2081 2016-07-06 2136 2020-11-20 πŸ”— πŸ”— πŸ”—
SMSSendB 2081 2016-07-06 2136 2020-11-20
TroviProxyApp Pirrit, VSearch 2081 2016-07-06 2081 2016-07-06 πŸ”— πŸ”—
VindinstallerA Vindinstaller, Vidsler 2081 2016-07-06 2136 2020-11-20 πŸ”—
VSearchA VSearch 2081 2016-07-06 2136 2020-11-20 πŸ”—
XcodeGhost 2081 2016-07-06 2136 2020-11-20
BundloreB 2092 2017-07-07 2092 2017-07-07
HMiningB 2092 2017-07-07 2092 2017-07-07
NetwireA Netwire, Wirenet 2092 2017-07-07 2092 2017-07-07 πŸ”— πŸ”— πŸ”—
OSX_Bundlore_A Bundlore 2092 2017-07-07 2092 2017-07-07 πŸ”— πŸ”—
OSX_Findzip_A FileCoder, Crypat, KeRanger 2092 2017-07-07 2092 2017-07-07 πŸ”— πŸ”— πŸ”—
OSX_HMining_C 2092 2017-07-07 2092 2017-07-07
OSX_iKitten_A MacDownload, Remolash, MacDownloader 2092 2017-07-07 2092 2017-07-07 πŸ”— πŸ”— πŸ”—
OSX_Proton_A 2092 2017-07-07 2092 2017-07-07
OSX_XAgent_A Xagent, Sofacy, APT28 2092 2017-07-07 2092 2017-07-07 πŸ”— πŸ”— πŸ”—
XProtect_OSX_ATG15_B OceanLotus 2092 2017-07-07 2092 2017-07-07 πŸ”— πŸ”— πŸ”—
XProtect_OSX_Dok_A 2092 2017-07-07 2136 2020-11-20
XProtect_OSX_Dok_B Dok, Aptordoc, Bella 2092 2017-07-07 2092 2017-07-07 πŸ”— πŸ”— πŸ”—
XProtect_OSX_Genieo_G Genieo 2092 2017-07-07 2136 2020-11-20 πŸ”— πŸ”— πŸ”—
XProtect_OSX_Proton_B Proton 2092 2017-07-07 2092 2017-07-07 πŸ”— πŸ”— πŸ”—
OSX_ExtensionsInstaller_A 2095 2017-09-29 2095 2017-09-29
XProtect_AdLoad_A 2095 2017-09-29 2095 2017-09-29
XProtect_Bundlore_B Bundlore 2095 2017-09-29 2095 2017-09-29 πŸ”— πŸ”—
XProtect_Genieo_G_1 Genieo 2095 2017-09-29 2095 2017-09-29 πŸ”— πŸ”— πŸ”—
XProtect_OSX_AceInstaller_B 2095 2017-09-29 2095 2017-09-29
XProtect_OSX_Leverage_A Leverage, Seadoor 2095 2017-09-29 2095 2017-09-29 πŸ”— πŸ”— πŸ”—
XProtect_OSX_Mughthesec_A Adload, Cimpli, Mughthesec 2095 2017-09-29 2095 2017-09-29 πŸ”— πŸ”— πŸ”—
XProtect_AdLoad_B_1 2099 2018-03-13 2099 2018-03-13
XProtect_AdLoad_B_2 2099 2018-03-13 2099 2018-03-13
XProtect_OSX_28a9883 2099 2018-03-13 2099 2018-03-13
XProtect_OSX_Bundlore_D 2099 2018-03-13 2099 2018-03-13
XProtect_OSX_HiddenLotus_A OceanLotus, HiddenLotus, Occamy 2099 2018-03-13 2099 2018-03-13 πŸ”— πŸ”— πŸ”—
XProtect_OSX_HMining_D 2099 2018-03-13 2099 2018-03-13
XProtect_OSX_Mughthesec_B Adload, Cimpli, Mughthesec 2099 2018-03-13 2099 2018-03-13 πŸ”— πŸ”— πŸ”—
XProtect_OSX_Particle_Smasher_A Proton 2099 2018-03-13 2099 2018-03-13 πŸ”— πŸ”—
XProtect_MACOS_d1e06b8 Winplyer, Wajam, InstallCapital 2102 2019-04-19 2102 2019-04-19 πŸ”— πŸ”—
XProtect_MACOS_6175e25 AMCleaner, AMC, GT32SupportGeeks, AdvancedMacCleaner 2103 2019-05-01 2103 2019-05-01 πŸ”— πŸ”—
XProtect_MACOS_22d71e9 Adload, Cimpli, Mughthesec 2108 2019-11-13 2135 2020-11-13 πŸ”— πŸ”—
XProtect_MACOS_b70290c Adload, Cimpli 2108 2019-11-13 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_de444f2 Adload, Cimpli, Mughthesec 2108 2019-11-13 2135 2020-11-13 πŸ”— πŸ”—
XProtect_MACOS_0e62876 Bundlore 2109 2019-12-10 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_9bdf6ec Adload 2109 2019-12-10 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_d92d83c Bundlore 2109 2019-12-10 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_e79dc35 Adload 2109 2019-12-10 2127 2020-07-23 πŸ”— πŸ”—
XProtect_MACOS_03b5cbe Genieo 2111 2020-01-07 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_5af1486 Genieo 2111 2020-01-07 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_ce3281e Genieo 2111 2020-01-07 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_60a3d68 Bundlore, Shlayer 2112 2020-01-23 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_8283b86 AMCleaner, AMC, GT32SupportGeeks, AdvancedMacCleaner 2112 2020-01-23 2112 2020-01-23 πŸ”— πŸ”—
XProtect_MACOS_b264ff6 AMCleaner, AMC, GT32SupportGeeks, AdvancedMacCleaner 2112 2020-01-23 2112 2020-01-23 πŸ”— πŸ”—
XProtect_MACOS_f3edc61 AMCleaner, AMC, GT32SupportGeeks, AdvancedMacCleaner 2112 2020-01-23 2112 2020-01-23 πŸ”— πŸ”—
XProtect_MACOS_489e70f Genieo, Grader 2116 2020-03-19 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_c592675 Pirrit 2116 2020-03-19 2116 2020-03-19 πŸ”—n πŸ”—
XProtect_MACOS_30445d1 2121 2020-05-14 2136 2020-11-20
XProtect_MACOS_51f7dde RefogKeylogger, RefogMonitor, Refog 2121 2020-05-14 2121 2020-05-14 πŸ”— πŸ”—
XProtect_MACOS_7f5b902 2121 2020-05-14 2136 2020-11-20
XProtect_MACOS_a291b70 2121 2020-05-14 2121 2020-05-14
XProtect_MACOS_2b3d4cb NukeSped 2125 2020-07-07 2125 2020-07-07 πŸ”— πŸ”— πŸ”—
XProtect_MACOS_3ea93d1 2125 2020-07-07 2125 2020-07-07
XProtect_MACOS_61ee022 2125 2020-07-07 2136 2020-11-20
XProtect_MACOS_6cb9746 MacRansom, EvilQuest, Filecoder, ThiefQuest 2125 2020-07-07 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_8032420 Adload, MaxOfferDeal 2125 2020-07-07 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_8340d93 2125 2020-07-07 2125 2020-07-07
XProtect_MACOS_8d038b3 Lazarus, NukeSped 2125 2020-07-07 2125 2020-07-07 πŸ”— πŸ”—
XProtect_MACOS_b17a97e Lazarus, NukeSped 2125 2020-07-07 2125 2020-07-07 πŸ”— πŸ”—
XProtect_MACOS_bb90861 2125 2020-07-07 2136 2020-11-20
XProtect_MACOS_bd64115 2125 2020-07-07 2125 2020-07-07
XProtect_MACOS_c723519 2125 2020-07-07 2125 2020-07-07
XProtect_MACOS_cb4abc2 Lazarus, NukeSped, Dacls 2125 2020-07-07 2125 2020-07-07 πŸ”— πŸ”— πŸ”—
XProtect_MACOS_e4644f7 2125 2020-07-07 2125 2020-07-07
XProtect_MACOS_f4a3a92 2125 2020-07-07 2125 2020-07-07
XProtect_MACOS_fa6a259 Lazarus, NukeSped, Mata 2125 2020-07-07 2125 2020-07-07 πŸ”— πŸ”— πŸ”—
XProtect_MACOS_2070d41 XCSSET 2126 2020-07-13 2136 2020-11-20 πŸ”— πŸ”— πŸ”—
XProtect_MACOS_260ae81 2127 2020-07-23 2127 2020-07-23
XProtect_MACOS_580a1bc 2127 2020-07-23 2127 2020-07-23
XProtect_MACOS_449a7ed Bundlore 2131 2020-09-17 2131 2020-09-17 πŸ”— πŸ”—
XProtect_MACOS_71915a8 2131 2020-09-17 2131 2020-09-17
XProtect_MACOS_a9ea9b4 Bundlore 2131 2020-09-17 2131 2020-09-17 πŸ”— πŸ”—
XProtect_MACOS_d444820 2131 2020-09-17 2131 2020-09-17
XProtect_MACOS_1c119be 2134 2020-10-29 2134 2020-10-29
XProtect_MACOS_1f26189 2134 2020-10-29 2134 2020-10-29
XProtect_MACOS_6e7d4c2 MacSearch, Ketin, Genieo 2134 2020-10-29 2134 2020-10-29 πŸ”— πŸ”—
XProtect_MACOS_8f20223 2134 2020-10-29 2134 2020-10-29
XProtect_MACOS_d4735e3 2134 2020-10-29 2136 2020-11-20
XProtect_MACOS_e3548bb 2134 2020-10-29 2134 2020-10-29
XProtect_MACOS_1373c52 Adload, Synataeb 2136 2020-11-20 2136 2020-11-20 πŸ”— πŸ”—
XProtect_MACOS_e16be2c Pirrit 2137 2020-11-17 2137 2020-11-17 πŸ”— πŸ”—
@nikolay-n
Copy link
Author

πŸ™ If you have samples to share, please post links in a comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment