YARA · Trellix Advanced Research Center

TRELLIX_ARC_Milum_Trojan

Rule to detect Milum trojan from the Wildpressure operation

MalwareMilumTrellix Advanced Research CenterApache License 2.0Kompiliert mit YARA-X

Autor: Marc Rivero | McAfee ATR Team
Datum: 2020-04-24
Geändert: 2020-08-14
Score / Qualität: 75 / 70

Was diese Regel erkennt

Rule to detect Milum trojan from the Wildpressure operation

Zugehörige Malware-Familie: Milum.

Ziele: Windows-PE.

Sie definiert 1 Muster (0 Text, 1 Hex, 0 Regex). Verwendete YARA-Module: pe.

Zusammenfassung aus den Metadaten und der Bedingung der Regel erzeugt.

Regelquelltext

.yar herunterladen

Enthält die Imports, die zum eigenständigen Kompilieren nötig sind.

milum-trojan.yarApache License 2.0

import "pe"

rule TRELLIX_ARC_Milum_Trojan : TROJAN FILE
{
	meta:
		description = "Rule to detect Milum trojan from the Wildpressure operation"
		author = "Marc Rivero | McAfee ATR Team"
		id = "acc56237-a93a-55c0-a90c-11ca1da683db"
		date = "2020-04-24"
		modified = "2020-08-14"
		reference = "https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_milum_wildpressure.yar#L3-L28"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9"
		logic_hash = "3ab1ff129517cb4a829edac289c00d7701d6f667ba2ef5a28024fd01a3a52e8e"
		score = 75
		quality = 70
		tags = "TROJAN, FILE"
		rule_version = "v1"
		malware_type = "trojan"
		malware_family = "Trojan:W32/Milum"
		actor_type = "Apt"
		actor_group = "Unknown"

	strings:
		$pattern = { 558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????89??????????C7????????????8D????C7??????????33??6A??89??????????89????E8????????83????3B??0F84????????89????89??8B????89????8B????89????8B????C6??????8B????C6??????C6??????8B??????????BE????????89????89????88????C6??????6A??68????????8D??????????89??????????89??????????88??????????E8????????C6??????6A??538D????528D??????????89??????????89??????????88??????????E8????????C6??????8D??????????508B??E8????????508D??????????5157E8????????C6??????83????????????72??8B??????????52E8????????83????89??????????89??????????88??????????C6??????83????????????72??8B??????????50E8????????83????6A??68????????8D????89??????????89??????????88??????????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????83??????72??8B????51E8????????83????89????89????88????C6??????83??????72??8B????52E8????????83????6A??68????????8D????89????89????88????89????89????88????E8????????C6??????6A??538D????508D????89????89????88????E8????????C6??????83????8B??89??????????6A??89????89????68????????88??E8????????C6??????83????8B??89??????????6A??538D????89????89????5288??E8????????C6??????8D??????????50C6??????E8????????83????C6??????8B??????????2B??????????B8????????F7??03??C1????8B??C1????03??83????75??8B??????????6A??53528D????E8????????8B??????????6A??83????53508D????E8????????6A??538D????508D????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????BF????????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????8B??????????3B??74??8B??????????E8????????8B??????????50E8????????83????BF????????89??????????89??????????89??????????C6??????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????39????72??8B????50E8????????83????89????89????88????88????39????72??8B????51E8????????83????89????89????88????C7????????????39????72??8B????52E8????????83????8B??????????89????89????88????8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????8D??????????508D??????????89??????????E8????????C6??????C7??????????????????C6??????68????????8D??????????51E8????????CCCC558B??6A??68????????64??????????5051535657A1????????33??508D????64??????????8B????C7??????????C7????????????8D????33??83??????89????72??8B??EB??8B??8D????88??8B????8B????518B??E8????????8B????89????8B????89??8B????89????89????88????83??????72??8B??50E8????????83????89????C7????????????88??83????89????89????C7????????????8B????8B??50518D????E8????????89????8B????52E8????????83????8B????64????????????595F5E5B8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????505156A1????????33??508D????64??????????83????C7????????????8B????5156E8????????C7????????????C7????????????8B??8B????64????????????595E8B??5DC2????CCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????33??8B??89??????????8B????8B??89??????????89??????????89??????????3B??0F84????????8D????39??????????0F85????????68????????8D????5750E8????????C7????????????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????E9????????578D????68????????51E8????????C7????????????508D??????????52BA????????E8????????C6??????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????C6??????39??????????72??8B??????????50E8????????83????C7??????????????????89??????????88??????????88????39????72??8B????51E8????????83????C7????????????89????88????FF??????????38????75??8B????38????75??8B??8B??38????75??8D????8B??8B??38????74??EB??8B????38????75??3B????75??8B??8B????38????74??8B??8B??????????3B????0F85????????8B??????????8B??6A??5383????C7????????????89????508B??88??E8????????89????C7??????????????????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????C7????????????89????88????8B????64????????????595E5B8B??5DC3CCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????5356508D????64??????????33??89????538B??68????????8D????89????C7????????????89????88????E8????????C7????????????6A??8D????38????74??68????????EB??68????????E8????????8D????5083????8D????5651E8????????C6??????8D????52578B??E8????????83????C7????????????C6??????BE????????39????72??8B????50E8????????83????C7????????????89????88????88????39????72??8B????51E8????????83????C7????????????89????88????8B??8B????64????????????595E5B8B????33??E8????????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????F6??????C7????????????89????88????74??56E8????????83????8B??8B????64????????????595E5B8B??5DC2????CCCC558B??6A??68????????64??????????50A1????????33??508D????64??????????C7????????????6A??6A??8D????5083????E8????????C7????????????83??????72??8B????51E8????????83????C7????????????C7????????????C6??????8B????64????????????598B??5DC2????CCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????535657508D????64??????????33??89????8B????89????89????B8????????89????C7????????????89????88??89????8D????BF????????39????72??8B??8B????39????73??8D????8B????518D????518B??E8????????C6??????508B??E8????????C6??????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B??33??89????8B????89??????????89?????????? }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and pe.imphash ( ) == "548d9f5f1e74f34b85612667335d41f2" and all of them
}

Strings (1 Muster)

Bezeichner	Typ	Wert	Modifikatoren
$pattern	Hex	{ 558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????89??????????C7????????????8D????C7??????????33??6A??89?????? …

Bedingung

uint16( 0 ) == 0x5a4d and filesize < 2000KB and pe.imphash ( ) == "548d9f5f1e74f34b85612667335d41f2" and all of them

In Worten (Heuristik)

Die Datei muss mit „MZ“ beginnen — eine Windows-Programmdatei (PE).
Die Datei muss kleiner als 2000KB sein (eine günstige Grenze, die große Dateien ausschließt).
Alle Muster aus der Regel müssen treffen.
Nutzt das Modul pe.
Prüft den PE-Import-Hash (imphash).

Diese Regel im Browser testen

Legen Sie eine Datei ab, um sie mit dieser Regel und YARA-X als WebAssembly zu scannen. Nichts wird hochgeladen.

Datei hier ablegen oder klicken zum AuswählenLokal mit YARA-X gescannt. Dateien bis 200 MB.

Im Editor öffnen

Referenzen

https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/

Proben-Hashes

Hashes der Proben, die der Autor in den Metadaten der Regel nennt (in Ihrer Threat-Intelligence-Plattform nachschlagen).

86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9

Lizenz & Namensnennung

Autor: Marc Rivero | McAfee ATR Team

Quell-Repository: Trellix Advanced Research Center @ 1919562a59

Lizenz: Apache License 2.0 (Repository-Lizenz)

Originalregel

Gespiegelt über YARA Forge 20260927, das Regelnamen mit der Quelle präfixiert und normalisierte Meta-Felder ergänzt.

Regel-ID: acc56237-a93a-55c0-a90c-11ca1da683db

Metadaten

rule_version	v1
malware_type	trojan
malware_family	Trojan:W32/Milum
actor_type	Apt
actor_group	Unknown

Tags:TROJAN FILE

MALPEDIA_Win_Milum_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
ARKBIRD_SOLG_MAL_Milum_Jul_2021_1Nur Metadaten
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-08
TRELLIX_ARC_Chimera_Recordedtv_Modified
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-21
TRELLIX_ARC_Cryptonar_Ransomware
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2026-09-01
TRELLIX_ARC_Malw_Eicar
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2026-09-01
TRELLIX_ARC_Rietspoof_Loader
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2026-09-01
TRELLIX_ARC_MALW_Emotet
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-07-21
TRELLIX_ARC_MALW_Fritzfrog
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-08-20

Weitere Milum-Regeln