New Coverage: 51 Fresh Malware Families in the ThreatClaw YARA Feed
The August rule release adds 51 new malware families to the YARA feed, forged from live in-the-wild samples, every rule compile-validated on the real engine with zero false positives on a benign corpus.
This release adds 51 new malware families to the ThreatClaw YARA feed, 2,613 new family-level rules, taking the pack past 17,000 rules. Every one was forged from live samples collected in the wild, not scraped from a public repository.
What landed
The batch leans heavily toward what is actually hitting networks right now:
- Ransomware: Conti, Ryuk, Hive, Maze, Cryptolocker, HelloKitty, Lynx, Knight, Qilin, Play, RansomHub, Mespinoza (Pysa), Snatch, BKRansomware, VirLock
- Infostealers: Stealc, Vidar, Agent Tesla, Luca, Rusty, SalatStealer, BlankGrabber, CryptBot, Loki, GCleaner, HawkEye
- Loaders: Amadey, IcedID, DarkGate, SmokeLoader, Nymaim, Karagany
- RATs: njRAT, Remcos, XWorm, NetWire, Poet, Drokbk
- Botnets: Emotet, Tofsee, Satacom, ngrBot, Ramnit, Floxif
- Plus Sliver (command-and-control), FrostyGoop (ICS/OT), a targeted implant, and the XMRig miner.
How it is built
Each family's coverage is forged from real samples, generalising across the code the samples share rather than pinning a single hash that goes stale within days. That gives family-level detection with staying power.
Then comes the part that matters: every rule is compile-validated on the actual YARA engine, not a linter, and must produce zero matches against a benign corpus of thousands of clean files. A rule that does not compile, or that lights up on legitimate software, does not ship.
That gate is strict on purpose. Several well-known families in this batch initially tripped it, a handful of over-broad signatures per family matching clean binaries. Rather than ship the noise or drop the family, we surgically removed only the offending rules and re-verified the rest at zero false positives. The result is coverage you can deploy without drowning your analysts in alerts.
Signed, and ready to respond
The whole feed ships as an Ed25519-signed release, and every detection carries its investigation playbook in CACAO 2.0 · because detection without response is just a louder alarm.
Try the free demo pack, no form, no funnel: threatclaw.io/en/feeds
Related articles
ThreatClaw adds YARA-based detection for Cryptolocker ransomware. Learn how this threat encrypts data, disrupts recovery, and why SMBs/MSSPs must act now.
Conti ransomware remains a top threat to SMBs. Learn how it operates, its MITRE ATT&CK techniques, and how ThreatClaw now detects it with zero false positives.
Bkransomware targets SMBs with encryption and recovery disruption. ThreatClaw now ships 39 validated YARA rules to detect this emerging ransomware threat.
Avoslocker ransomware targets SMBs with encryption and recovery disruption. Learn how ThreatClaw’s YARA rules now detect this threat to protect clients.