Tangerine Turkey Malware Analysis & Yara Rule

New technical analysis of Tangerine Turkey - a sophisticated cryptomining operation spreading via USB and abusing Windows LOLBins.

Key Findings:

• USB VBS dropper with worm capabilities
• LOLBin abuse (printui.exe)
• Multi-stage persistence
• XMRig miner payload

My Contribution:
Developed custom Yara rule detecting:

• VBS/BAT components
• Service creation
• Defender evasion
• Known IOCs

Practical detection for SOC teams against this emerging threat.

#MalwareAnalysis #CyberSecurity #YaraRules #ThreatHunting