Broomstick (Malware Family)

Broomstick

aka: CLEANBOOST, CleanUp, CleanUpLoader, Oyster

VTCollection

Oyster is a backdoor malware written in C++ that first appeared in July 2023. It allows for remote sessions, supporting tasks such as file transfer and command-line processing. This malware has been used by numerous threat actors as a tool to facilitate ransomware intrusions. The distribution of Oyster has likely occurred through various methods, as suggested by the build identifiers found in examined samples. Additionally, Oyster is capable of collecting basic system data and communicates with a command-and-control (C2) server. It can execute commands via cmd.exe and run additional files.

In August 2024, a new version of Oyster was discovered that featured a new command-and-control (C2) communication protocol format. This 2024 version contained plaintext strings and lacked code obfuscation, suggesting it was still in development. In contrast to the 2024 version, the new 2025 Oyster version does not send C2 messages in plaintext, instead reintroducing the substitution cipher that was present in earlier versions of Oyster.

References

2026-05-19 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Exposing Fox Tempest: A malware-signing service operation (Podcast)
Akira Rhysida Akira BlackByte BlueSky Broomstick Lumma Stealer Rhysida Spyder Vidar Fox Tempest

2026-05-19 ⋅ Microsoft ⋅ Steven Masada
Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware
Akira INC Qilin Rhysida AgendaCrypt Akira Broomstick INC Lumma Stealer Rhysida Vidar Fox Tempest

2026-05-19 ⋅ The Record ⋅ Jonathan Greig
Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs
Akira INC Qilin Rhysida AgendaCrypt Akira Broomstick INC Lumma Stealer Rhysida Vidar Fox Tempest

2026-02-12 ⋅ Sekoia ⋅ Pierre Le Bourhis
OysterLoader Unmasked: The Multi-Stage Evasion Loader
Broomstick

2026-01-06 ⋅ Reversing Labs ⋅ Robert Simmons
Unpacking the packer ‘pkr_mtsi’
Broomstick Supper

2025-10-31 ⋅ Expel ⋅ AARON WALTON
Certified OysterLoader: Tracking Rhysida ransomware gang activity via code-signing certificates
Broomstick

2025-09-28 ⋅ Malasada Tech ⋅ Aaron Samala
Oyster Malware Delivery via Teams Fake App
Broomstick

2025-09-26 ⋅ BlackPoint ⋅ Nevan Beal, Sam Decker
Malicious Teams Installers Drop Oyster Malware
Broomstick

2025-08-23 ⋅ LevelBlue ⋅ Jeff Kieschnick
Like PuTTY in Admin’s Hands
Broomstick

2025-07-24 ⋅ Red Canary ⋅ The Red Canary Team
Intelligence Insights: July 2025
Broomstick

2025-01-30 ⋅ Recorded Future ⋅ Insikt Group
TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base
Rhysida KongTuke MintsLoader Broomstick Remcos Rhysida WarmCookie

2024-12-12 ⋅ Hunt.io ⋅ Hunt.io
Oyster’s Trail: Resurgence of Infrastructure Linked to Ransomware and Cybercrime Actors
Broomstick

2024-10-09 ⋅ Recorded Future ⋅ Insikt Group
Outmaneuvering Rhysida: How Advanced Threat Intelligence Shields Critical Infrastructure from Ransomware
Broomstick Rhysida

2024-07-25 ⋅ Symantec ⋅ Symantec
Growing Number of Threats Leveraging AI
Broomstick DBatLoader NetSupportManager RAT Rhadamanthys

2024-07-24 ⋅ ThreatDown ⋅ ThreatDown
Rhysida using Oyster Backdoor to deliver ransomware
Broomstick Rhysida

2024-07-23 ⋅ Hunt.io ⋅ Hunt.io
A Simple Approach to Discovering Oyster Backdoor Infrastructure
Broomstick

2024-06-17 ⋅ Rapid7 ⋅ Rapid7
Malvertising Campaign Leads to Execution of Oyster Backdoor
Broomstick ChrGetPdsi Stealer

2024-01-25 ⋅ IBM ⋅ IBM
Broomstick Analysis Report (IRIS-17079)
Broomstick

2024-01-05 ⋅ IBM ⋅ IBM X-Force Exchange
Tomb Crypter and ChrGetPdsi Stealer Analysis Report (INT00011701)
Broomstick ChrGetPdsi Stealer

Yara Rules

[TLP:WHITE] win_broomstick_auto (20260917 | Detects win.broomstick.)

rule win_broomstick_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.broomstick."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.broomstick"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 2bc2 83c002 99 83e203 03c2 }
            // n = 5, score = 2200
            //   2bc2                 | sub                 eax, edx
            //   83c002               | add                 eax, 2
            //   99                   | cdq                 
            //   83e203               | and                 edx, 3
            //   03c2                 | add                 eax, edx

        $sequence_1 = { 8b45d4 8b75d0 2bc6 894ddc 51 52 3bc8 }
            // n = 7, score = 2100
            //   8b45d4               | mov                 eax, dword ptr [ebp - 0x2c]
            //   8b75d0               | mov                 esi, dword ptr [ebp - 0x30]
            //   2bc6                 | sub                 eax, esi
            //   894ddc               | mov                 dword ptr [ebp - 0x24], ecx
            //   51                   | push                ecx
            //   52                   | push                edx
            //   3bc8                 | cmp                 ecx, eax

        $sequence_2 = { c6400100 8808 eb13 ff75e8 }
            // n = 4, score = 2100
            //   c6400100             | mov                 byte ptr [eax + 1], 0
            //   8808                 | mov                 byte ptr [eax], cl
            //   eb13                 | jmp                 0x15
            //   ff75e8               | push                dword ptr [ebp - 0x18]

        $sequence_3 = { 80b9????????3f 76f3 2bc2 83c002 }
            // n = 4, score = 2100
            //   80b9????????3f       |                     
            //   76f3                 | jbe                 0xfffffff5
            //   2bc2                 | sub                 eax, edx
            //   83c002               | add                 eax, 2

        $sequence_4 = { 03f0 56 e8???????? 8b45dc 83c40c c6040600 }
            // n = 6, score = 2100
            //   03f0                 | add                 esi, eax
            //   56                   | push                esi
            //   e8????????           |                     
            //   8b45dc               | mov                 eax, dword ptr [ebp - 0x24]
            //   83c40c               | add                 esp, 0xc
            //   c6040600             | mov                 byte ptr [esi + eax], 0

        $sequence_5 = { 83c40c c6040600 eb10 c645dc00 }
            // n = 4, score = 2100
            //   83c40c               | add                 esp, 0xc
            //   c6040600             | mov                 byte ptr [esi + eax], 0
            //   eb10                 | jmp                 0x12
            //   c645dc00             | mov                 byte ptr [ebp - 0x24], 0

        $sequence_6 = { 51 50 51 8bce e8???????? 8b4dec }
            // n = 6, score = 2100
            //   51                   | push                ecx
            //   50                   | push                eax
            //   51                   | push                ecx
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   8b4dec               | mov                 ecx, dword ptr [ebp - 0x14]

        $sequence_7 = { 83c408 33c0 c7467000000000 c7467407000000 66894660 }
            // n = 5, score = 2100
            //   83c408               | add                 esp, 8
            //   33c0                 | xor                 eax, eax
            //   c7467000000000       | mov                 dword ptr [esi + 0x70], 0
            //   c7467407000000       | mov                 dword ptr [esi + 0x74], 7
            //   66894660             | mov                 word ptr [esi + 0x60], ax

        $sequence_8 = { 49898688490300 488d4c2420 41ffd4 4889f1 }
            // n = 4, score = 100
            //   49898688490300       | and                 edx, 3
            //   488d4c2420           | jbe                 0xfffffff5
            //   41ffd4               | sub                 eax, edx
            //   4889f1               | add                 eax, 2

        $sequence_9 = { ba01000000 488bf0 ff15???????? 4533c9 }
            // n = 4, score = 100
            //   ba01000000           | mov                 edx, 0xf774fe
            //   488bf0               | dec                 eax
            //   ff15????????         |                     
            //   4533c9               | mov                 ecx, edi

        $sequence_10 = { 49898688420300 48b8111ed81f4f83a99f 49898690420300 488d4c2420 }
            // n = 4, score = 100
            //   49898688420300       | push                dword ptr [ebp - 0x24]
            //   48b8111ed81f4f83a99f     | push    ecx
            //   49898690420300       | lea                 ecx, [ebp - 0x40]
            //   488d4c2420           | mov                 byte ptr [eax + 1], 0

        $sequence_11 = { 49898688410300 b9f0712400 4c8b25???????? 41ffd4 }
            // n = 4, score = 100
            //   49898688410300       | mov                 eax, dword ptr [ebp - 0x2c]
            //   b9f0712400           | mov                 esi, dword ptr [ebp - 0x30]
            //   4c8b25????????       |                     
            //   41ffd4               | sub                 eax, esi

        $sequence_12 = { ba01000000 488d8120630400 ffd0 488b05???????? }
            // n = 4, score = 100
            //   ba01000000           | dec                 eax
            //   488d8120630400       | lea                 ecx, [ebp + 0x580]
            //   ffd0                 | mov                 edx, 1
            //   488b05????????       |                     

        $sequence_13 = { ba01000000 49898565230300 488bce 48b8234a9581780326f6 }
            // n = 4, score = 100
            //   ba01000000           | mov                 edi, eax
            //   49898565230300       | dec                 eax
            //   488bce               | mov                 eax, 0x6d1f6421
            //   48b8234a9581780326f6     | inc    ecx

        $sequence_14 = { 49898688680300 4889f1 4889fa 4c8b2d???????? }
            // n = 4, score = 100
            //   49898688680300       | mov                 dword ptr [esi + 0x70], 0
            //   4889f1               | mov                 dword ptr [esi + 0x74], 7
            //   4889fa               | mov                 word ptr [esi + 0x60], ax
            //   4c8b2d????????       |                     

        $sequence_15 = { ba01000000 49898602940300 488bcf 48b81e53fbe65dc7397c }
            // n = 4, score = 100
            //   ba01000000           | adc                 bl, bh
            //   49898602940300       | dec                 eax
            //   488bcf               | lea                 ecx, [ebp + 0x4f8]
            //   48b81e53fbe65dc7397c     | dec    eax

        $sequence_16 = { 668930 488d9300010000 4883bb1801000007 7607 }
            // n = 4, score = 100
            //   668930               | add                 esp, 0xc
            //   488d9300010000       | mov                 byte ptr [esi + eax], 0
            //   4883bb1801000007     | jmp                 0x19
            //   7607                 | mov                 byte ptr [ebp - 0x24], 0

        $sequence_17 = { ba01000000 488bf8 ff15???????? 488d8d80050000 }
            // n = 4, score = 100
            //   ba01000000           | mov                 ecx, ebx
            //   488bf8               | mov                 edx, 1
            //   ff15????????         |                     
            //   488d8d80050000       | dec                 eax

        $sequence_18 = { 668930 488d5320 48837b3807 7604 }
            // n = 4, score = 100
            //   668930               | mov                 dword ptr [esi + 0x70], 0
            //   488d5320             | mov                 dword ptr [esi + 0x74], 7
            //   48837b3807           | sub                 eax, edx
            //   7604                 | add                 eax, 2

        $sequence_19 = { ba01000000 488bd8 ff15???????? 488bd6 }
            // n = 4, score = 100
            //   ba01000000           | dec                 eax
            //   488bd8               | mov                 ecx, edi
            //   ff15????????         |                     
            //   488bd6               | mov                 edx, 1

        $sequence_20 = { ba01000000 488bcf ff15???????? ba93383100 488bcf }
            // n = 5, score = 100
            //   ba01000000           | mov                 edx, 1
            //   488bcf               | dec                 eax
            //   ff15????????         |                     
            //   ba93383100           | mov                 ecx, edi
            //   488bcf               | mov                 edx, 0x313893

        $sequence_21 = { 49898688320300 b9bc474300 41ffd4 4889c7 4889c1 }
            // n = 5, score = 100
            //   49898688320300       | push                edx
            //   b9bc474300           | cmp                 ecx, eax
            //   41ffd4               | mov                 eax, dword ptr [ebp - 0x24]
            //   4889c7               | add                 esp, 0xc
            //   4889c1               | mov                 byte ptr [esi + eax], 0

        $sequence_22 = { 49898688430300 4889f1 ba97000000 41b8cb000000 }
            // n = 4, score = 100
            //   49898688430300       | cmp                 ecx, 0x1000
            //   4889f1               | jb                  0x25
            //   ba97000000           | mov                 edx, dword ptr [eax - 4]
            //   41b8cb000000         | sub                 eax, edx

        $sequence_23 = { 668930 488b542438 4883fa07 7637 488d145502000000 488b4c2420 488bc1 }
            // n = 7, score = 100
            //   668930               | push                esi
            //   488b542438           | mov                 eax, dword ptr [ebp - 0x24]
            //   4883fa07             | add                 esp, 0xc
            //   7637                 | mov                 byte ptr [esi + eax], 0
            //   488d145502000000     | push                ecx
            //   488b4c2420           | push                eax
            //   488bc1               | push                ecx

        $sequence_24 = { 49898688360300 488d4c2420 41ffd7 4889f1 }
            // n = 4, score = 100
            //   49898688360300       | mov                 eax, dword ptr [ebp - 0x24]
            //   488d4c2420           | add                 esp, 0xc
            //   41ffd7               | mov                 byte ptr [esi + eax], 0
            //   4889f1               | jmp                 0x19

        $sequence_25 = { ba01000000 49898612ff0300 488bcf 48b81f58d5789b9e337f }
            // n = 4, score = 100
            //   ba01000000           | mov                 eax, 0x93eb2949
            //   49898612ff0300       | mov                 edx, 1
            //   488bcf               | dec                 eax
            //   48b81f58d5789b9e337f     | mov    edi, eax

        $sequence_26 = { 668930 488d9320010000 4883bb3801000007 7607 }
            // n = 4, score = 100
            //   668930               | ja                  0x30
            //   488d9320010000       | add                 esp, 8
            //   4883bb3801000007     | xor                 eax, eax
            //   7607                 | mov                 dword ptr [esi + 0x70], 0

        $sequence_27 = { 668930 488d5517 48837d2f07 480f475517 }
            // n = 4, score = 100
            //   668930               | add                 esp, 0xc
            //   488d5517             | mov                 byte ptr [esi + eax], 0
            //   48837d2f07           | jmp                 0x1d
            //   480f475517           | mov                 eax, dword ptr [ebp - 0x2c]

        $sequence_28 = { 498986885f0300 4889f1 ba02000000 ffd3 }
            // n = 4, score = 100
            //   498986885f0300       | mov                 byte ptr [esi + eax], 0
            //   4889f1               | jmp                 0x12
            //   ba02000000           | mov                 byte ptr [ebp - 0x24], 0
            //   ffd3                 | push                dword ptr [ebp - 0x24]

        $sequence_29 = { 668930 488d5340 48837b5807 7604 }
            // n = 4, score = 100
            //   668930               | jbe                 0xfffffff6
            //   488d5340             | sub                 eax, edx
            //   48837b5807           | push                esi
            //   7604                 | mov                 eax, dword ptr [ebp - 0x24]

        $sequence_30 = { 668930 488b559f 4883fa07 7636 }
            // n = 4, score = 100
            //   668930               | mov                 ecx, esi
            //   488b559f             | mov                 ecx, dword ptr [ebp - 0x14]
            //   4883fa07             | push                esi
            //   7636                 | mov                 eax, dword ptr [ebp - 0x24]

    condition:
        7 of them and filesize < 1567744
}

Download all Yara Rules

Broomstick Propose Change

References

Yara Rules

Broomstick