Skip to content
yararules.org
Menu

YARA · Cado Security (via Open-Source-YARA-rules)

CADOSECURITY_Wiper_Ukr_Feb_2022

Detects Wiper seen in Ukraine 23rd Feb 2022

MalwareCado Security (via Open-Source-YARA-rules)Apache License 2.0Compiles with YARA-X
Author
cadosecurity.com
Date
2022-02-23
Modified
2023-04-10
Score / Quality
75 / 80

What this rule detects

Detects Wiper seen in Ukraine 23rd Feb 2022

Targets: Windows PE.

It defines 4 patterns (4 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
wiper-ukr-feb-2022.yarApache License 2.0
rule CADOSECURITY_Wiper_Ukr_Feb_2022 : FILE
{
	meta:
		description = "Detects Wiper seen in Ukraine 23rd Feb 2022"
		author = "cadosecurity.com"
		id = "98f80c1b-7575-51d4-8265-680ea204990a"
		date = "2022-02-23"
		modified = "2023-04-10"
		reference = "https://github.com/cado-security/wiper_feb_2022"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Wiper_Ukr_Feb_2022.yar#L1-L18"
		license_url = "N/A"
		hash = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
		logic_hash = "fa96b88c42bdd4ba437f090d781b38c5c7f9fcb690aeff4161f24aedb1870587"
		score = 75
		quality = 80
		tags = "FILE"
		license = "Apache License 2.0"

	strings:
		$ = "Hermetica Digital Ltd" wide ascii
		$ = "DRV_XP_X64" wide ascii
		$ = "Windows\\System32\\winevt\\Logs" wide ascii
		$ = "EPMNTDRV\\%u" wide ascii

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

Strings (4 patterns)

IdentifierTypeValueModifiers
$text"Hermetica Digital Ltd"wide ascii
$text"DRV_XP_X64"wide ascii
$text"Windows\\System32\\winevt\\Logs"wide ascii
$text"EPMNTDRV\\%u"wide ascii

Condition

uint16( 0 ) == 0x5A4D and all of them

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591

Licence & attribution

Author: cadosecurity.com

Source repository: Cado Security (via Open-Source-YARA-rules) @ ec0056f767

Licence: Apache License 2.0 (stated in the rule's own meta)

“Apache License 2.0”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 98f80c1b-7575-51d4-8265-680ea204990a

Tags:FILE