← Back to SOC feed Coverage →

Iron Tiger Malware - GTalk Trojan

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-27T11:00:00Z · Confidence: medium

Hunt Hypothesis

The Iron Tiger Malware - GTalk Trojan is likely being used to establish covert communication channels and exfiltrate data through compromised Azure environments. SOC teams should proactively hunt for this behavior to identify and mitigate potential data breaches and lateral movement attempts.

YARA Rule

rule IronTiger_GTalk_Trojan 
{
  
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - GTalk Trojan"
        reference = "http://goo.gl/T5fSJC"
  
    strings:
        $str1 = "gtalklite.com" nocase wide ascii
        $str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" nocase wide ascii
        $str3 = "D13idmAdm" nocase wide ascii
        $str4 = "Error: PeekNamedPipe failed with %i" nocase wide ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($str*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Irontiger.yar