Skip to content
Scanner for Regin Virtual Filesystems
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


The two specialiced scanners Regin Scanner and Skeleton Key Scanner have been merged into a new generic IOC scanner called LOKI.

LOKI features a completely free IOC signature definition via different configuration files. It includes signatures for Regin, Skeleton Key and the recently published FiveEyes QUERTY malware mentioned in the Spiegel report released on 17.01.2015.

LOKI is free for private and commercial use and published under the GPL. He is the little brother of THOR, our full featured corporate APT Scanner.


Scanner for Regin Backdoor

Detection is based on four detection methods:

  1. File Name IOC Based on the reports published by Symantec and Kaspersky

  2. Yara Ruleset Based on my rules published on pastebin:

  3. SHA256 hash check Compares known malicious SHA256 hashes with scanned files

  4. File System Scanner for Regin Virtual Filesystems based on .evt virtual filesystem detection by Paul Rascagneres, G DATA Reference:

The Windows binary is compiled with PyInstaller 2.1 and should run as x86 application on both x86 and x64 based systems.


No requirements if you use the compiled EXE.

If you want to build it yourself:

  • yara : It's recommended to use the most recent version of the compiled packages for Windows (x86) - Download it from here:
  • scandir : faster alternative to os.walk()
  • colorama : to color it up

Rule Base

The Yara rules published by Kaspersky are not bundled with this scanner. Extract them from the report and add them to the "regin_rules.yar" rule set to get better results. (Hint: Check the double quote signs " after copy&paste if errors occur)


´´´ usage: [-h] [-p path] [--dots] [--debug]

Regin Scanner

optional arguments: -h, --help show this help message and exit -p path Path to scan --dots Print a dot for every scanned file to see the progress --debug Debug output ´´´


ReginScanner reports system as clean


ReginScanner with detections



Profile on Company Homepage

Twitter @MalwrSignatures

If you are interested in a corporate solution for APT scanning, check:

You can’t perform that action at this time.