|4 min read|Yvann Lièvre

New Coverage: 51 Fresh Malware Families in the ThreatClaw YARA Feed

The August rule release adds 51 new malware families to the YARA feed, forged from live in-the-wild samples, every rule compile-validated on the real engine with zero false positives on a benign corpus.

ReleaseYARARansomwareThreat Detection
New Coverage: 51 Fresh Malware Families in the ThreatClaw YARA Feed

This release adds 51 new malware families to the ThreatClaw YARA feed, 2,613 new family-level rules, taking the pack past 17,000 rules. Every one was forged from live samples collected in the wild, not scraped from a public repository.

What landed

The batch leans heavily toward what is actually hitting networks right now:

  • Ransomware: Conti, Ryuk, Hive, Maze, Cryptolocker, HelloKitty, Lynx, Knight, Qilin, Play, RansomHub, Mespinoza (Pysa), Snatch, BKRansomware, VirLock
  • Infostealers: Stealc, Vidar, Agent Tesla, Luca, Rusty, SalatStealer, BlankGrabber, CryptBot, Loki, GCleaner, HawkEye
  • Loaders: Amadey, IcedID, DarkGate, SmokeLoader, Nymaim, Karagany
  • RATs: njRAT, Remcos, XWorm, NetWire, Poet, Drokbk
  • Botnets: Emotet, Tofsee, Satacom, ngrBot, Ramnit, Floxif
  • Plus Sliver (command-and-control), FrostyGoop (ICS/OT), a targeted implant, and the XMRig miner.

How it is built

Each family's coverage is forged from real samples, generalising across the code the samples share rather than pinning a single hash that goes stale within days. That gives family-level detection with staying power.

Then comes the part that matters: every rule is compile-validated on the actual YARA engine, not a linter, and must produce zero matches against a benign corpus of thousands of clean files. A rule that does not compile, or that lights up on legitimate software, does not ship.

That gate is strict on purpose. Several well-known families in this batch initially tripped it, a handful of over-broad signatures per family matching clean binaries. Rather than ship the noise or drop the family, we surgically removed only the offending rules and re-verified the rest at zero false positives. The result is coverage you can deploy without drowning your analysts in alerts.

Signed, and ready to respond

The whole feed ships as an Ed25519-signed release, and every detection carries its investigation playbook in CACAO 2.0 · because detection without response is just a louder alarm.

Try the free demo pack, no form, no funnel: threatclaw.io/en/feeds

Related articles