Allows attackers to customize the malware, choosing its icon, name, and specific permissions to blend in with legitimate applications.
Researchers from Cyfirma and Group-IB note that the malware is typically spread through: cypher rat evlf exclusive
CypherRAT is designed for total device compromise, utilizing a "builder" that allows customers to generate custom, obfuscated malicious packages. Its primary features include: Allows attackers to customize the malware, choosing its
rule Cypher_RAT_Generic meta: author = "sec-analyst" description = "Generic indicators for Cypher RAT family (illustrative)" date = "2026-04-09" strings: $s1 = "EVLF" nocase $s2 = "Cypher" ascii $s3 = "beacon" ascii condition: any of ($s*) and filesize < 5MB Allows attackers to customize the malware