YARA · Cado Security (via Open-Source-YARA-rules)
CADOSECURITY_Whispergate_Stage_1
Detects first stage payload from WhisperGate
- Author
- mmuir@cadosecurity.com
- Date
- 2022-01-17
- Modified
- 2023-04-10
- Score / Quality
- 75 / 72
What this rule detects
Detects first stage payload from WhisperGate
Associated malware family: Whispergate.
Targets: Windows PE.
It defines 4 patterns (0 text, 4 hex, 0 regex).
YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal
Summary generated from the rule's metadata and condition.
Rule source
rule CADOSECURITY_Whispergate_Stage_1 : FILE
{
meta:
= "Detects first stage payload from WhisperGate"
= "mmuir@cadosecurity.com"
= "603aa1f9-749f-5cce-b49f-0005b7949e2c"
= "2022-01-17"
= "2023-04-10"
= "https://github.com/cado-security/DFIR_Resources_Whispergate"
= "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Whispergate_Stage_1.yar#L1-L16"
= "N/A"
= "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
= "b8d8f2f56fe3a6f42699b7736386f9e8083fc728d06750f51064be1ff2f6620b"
= 75
= 72
= "FILE"
= "Apache License 2.0"
strings:
$a = { 31 41 56 4E 4D 36 38 67 6A 36 50 47 50 46 63 4A 75 66 74 4B 41 54 61 34 57 4C 6E 7A 67 38 66 70 66 76 }
$b = { 38 42 45 44 43 34 31 31 30 31 32 41 33 33 42 41 33 34 46 34 39 31 33 30 44 30 46 31 38 36 39 39 33 43 36 41 33 32 44 41 44 38 39 37 36 46 36 41 35 44 38 32 43 31 45 44 32 33 30 35 34 43 30 35 37 45 43 45 44 35 34 39 36 46 36 35 }
$c = { 24 31 30 6B 20 76 69 61 20 62 69 74 63 6F 69 6E 20 77 61 6C 6C 65 74 }
$d = { 74 6F 78 20 49 44 }
condition:
uint16( 0 ) == 0x5A4D and all of them
}
Strings (4 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $a | hex | { 31 41 56 4E 4D 36 38 67 6A 36 50 47 50 46 63 4A 75 66 74 4B 41 54 61 34 57 4C 6E 7A 67 38 66 70 66 76 } | |
| $b | hex | { 38 42 45 44 43 34 31 31 30 31 32 41 33 33 42 41 33 34 46 34 39 31 33 30 44 30 46 31 38 36 39 39 33 43 36 41 33 32 44 41 44 38 39 37 36 46 36 41 35 44 38 32 43 … | |
| $c | hex | { 24 31 30 6B 20 76 69 61 20 62 69 74 63 6F 69 6E 20 77 61 6C 6C 65 74 } | |
| $d | hex | { 74 6F 78 20 49 44 } |
Condition
uint16( 0 ) == 0x5A4D and all of themIn plain words (Heuristic)
- The file must start with “MZ” — a Windows executable (PE).
- All patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92
Licence & attribution
Author: mmuir@cadosecurity.com
Source repository: Cado Security (via Open-Source-YARA-rules) @ ec0056f767
Licence: Apache License 2.0 (stated in the rule's own meta)
“Apache License 2.0”
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 603aa1f9-749f-5cce-b49f-0005b7949e2c
Tags:FILE
Related rules
- MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
- MalwareCado Security (via Open-Source-YARA-rules)· mmuir@cadosecurity.com· 2022-04-12
- MalwareCado Security (via Open-Source-YARA-rules)· mmuir@cadosecurity.com· 2022-04-12
- MalwareCado Security (via Open-Source-YARA-rules)· mmuir@cadosecurity.com· 2022-04-12