Rule Info
Name
MAL_APT_Shellcode_Loader_Jul26
Author
MalGamy
Description
Detects a shellcode loader that uses a custom XOR based decryption routine to load and execute shellcode from memory, seen being used by OceanLotus APT group
Score
80
Date
2026-07-27
Minimum Yara
3.5.0
Rule Hash
b5b54b833dfda485f7b27f2a605add28
Tags
['G0050', 'APT', 'MAL', 'FILE', 'EXE']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
6
Suspicious (< 10 engines)
1
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR