YARA · Check Point (via Open-Source-YARA-rules)

CHECK_POINT_Apt_Nazar_Component_Guids

Detect Nazar Components by COM Objects' GUID

Author: Itay Cohen
Date: 2020-04-27
Modified: 2023-04-10
Score / Quality: 75 / 85

What this rule detects

Detect Nazar Components by COM Objects' GUID

It defines 6 patterns (0 text, 6 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from Check Point (via Open-Source-YARA-rules), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHub Open the repository

References

https://research.checkpoint.com/2020/nazar-spirits-of-the-past/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

1110c3e34b6bbaadc5082fabbdd69f492f3b1480724b879a3df0035ff487fd6f
1afe00b54856628d760b711534779da16c69f542ddc1bb835816aa92ed556390
2caedd0b2ea45761332a530327f74ca5b1a71301270d1e2e670b7fa34b6f338e
2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6
460eba344823766fe7c8f13b647b4d5d979ce4041dd5cb4a6d538783d96b2ef8
4d0ab3951df93589a874192569cac88f7107f595600e274f52e2b75f68593bca
75e4d73252c753cd8e177820eb261cd72fecd7360cc8ec3feeab7bd129c01ff6
8fb9a22b20a338d90c7ceb9424d079a61ca7ccb7f78ffb7d74d2f403ae9fbeec
967ac245e8429e3b725463a5c4c42fbdf98385ee6f25254e48b9492df21f2d0b
be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728
d34a996826ea5a028f5b4713c797247913f036ca0063cc4c18d8b04736fa0b65
d9801b4da1dbc5264e83029abb93e800d3c9971c650ecc2df5f85bcc10c7bd61
eb705459c2b37fba5747c73ce4870497aa1d4de22c97aaea4af38cdc899b51d3

Licence & attribution

Author: Itay Cohen

Source repository: Check Point (via Open-Source-YARA-rules) @ ec0056f767

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 1bdc0b54-4903-559d-9037-450470fc7ef7