YARA · Cado Security (via Open-Source-YARA-rules)

CADOSECURITY_Lambda_Malware

Detects AWS Lambda Malware

MalwareCado Security (via Open-Source-YARA-rules)Apache License 2.0Compiles with YARA-X

Author: cdoman@cadosecurity.com
Date: 2022-04-03
Modified: 2022-07-06
Score / Quality: 75 / 80

What this rule detects

Detects AWS Lambda Malware

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

lambda-malware.yarApache License 2.0

rule CADOSECURITY_Lambda_Malware : FILE
{
	meta:
		description = "Detects AWS Lambda Malware"
		author = "cdoman@cadosecurity.com"
		id = "cd867d39-7ff8-599a-bd65-e0f5581ac3f6"
		date = "2022-04-03"
		modified = "2022-07-06"
		reference = "https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Lambda_Malware.yar#L1-L17"
		license_url = "N/A"
		hash = "739fe13697bc55870ceb35003c4ee01a335f9c1f6549acb6472c5c3078417eed"
		hash = "a31ae5b7968056d8d99b1b720a66a9a1aeee3637b97050d95d96ef3a265cbbca"
		logic_hash = "46567ceeb39a3b3379fc5ee876e1539b24e8192af8fe31b5df16fb2b3105f176"
		score = 75
		quality = 80
		tags = "FILE"
		license = "Apache License 2.0"

	strings:
		$a = "github.com/likexian/doh-go/provider/"
		$b = "Mozilla/5.0 (compatible; Ezooms/1.0; help@moz.com)"
		$c = "username:password pair for mining server"

	condition:
		filesize < 30000KB and all of them
}

Strings (3 patterns)

Identifier	Type	Value
$a	text	"github.com/likexian/doh-go/provider/"
$b	text	"Mozilla/5.0 (compatible; Ezooms/1.0; help@moz.com)"
$c	text	"username:password pair for mining server"

Condition

filesize < 30000KB and all of them

In plain words (Heuristic)

The file must be smaller than 30000KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

739fe13697bc55870ceb35003c4ee01a335f9c1f6549acb6472c5c3078417eed
a31ae5b7968056d8d99b1b720a66a9a1aeee3637b97050d95d96ef3a265cbbca

Licence & attribution

Author: cdoman@cadosecurity.com

Source repository: Cado Security (via Open-Source-YARA-rules) @ ec0056f767

Licence: Apache License 2.0 (stated in the rule's own meta)

“Apache License 2.0”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: cd867d39-7ff8-599a-bd65-e0f5581ac3f6

Tags:FILE