>http://winduo.baselashraf.com/download.html

Public InfoSec YARA rules

Sensor

infosec_yara

Verdict

malware

Observed

2026-09-13

Trigger

release-assets.githubusercontent.com/github-production-release-asset/1367453846/66311dd1-914d-486c-8a29-7a17ff8b34e6?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-09-13T19%3A10%3A58Z&rscd=attachment%3B+filename%3DWinDuo.exe&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-09-13T18%3A10%3A30Z&ske=2026-09-13T19%3A10%3A58Z&sks=b&skv=2018-11-09&sig=bFPZ3AqbTq1Lz7Wy0WJ0RpU%2F6t0J%2Be%2FKGXeA%2BntYD5M%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4OTMyNTU4NCwibmJmIjoxNzg5MzIzNzg0LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.27R8KG7WclanNdTU9ygFjCRQMDam6EfsPNLDOzKJ90Q&response-content-disposition=attachment%3B%20filename%3DWinDuo.exe&response-content-type=application%2Foctet-stream

Reference

https://github.com/bartblaze/Yara-rules⧉

Metadata

{"author":"@bartblaze","category":"MALWARE","creation_date":"2020-01-01","description":"Identifies executable converted using PyInstaller.","fingerprint":"ae849936b19be3eb491d658026b252c2f72dcb3c07c6bddecb7f72ad74903eee","first_imported":"2021-12-30","id":"6Pyq57uDDAEHbltmbp7xRT","last_modified":"2021-12-30","rule":"PyInstaller","sharing":"TLP:WHITE","source":"BARTBLAZE","status":"RELEASED","version":"1.0"}