Skip to content
yararules.org
Menu

YARA · ditekSHen detection

DITEKSHEN_MALWARE_Osx_Techyutils

Detects TechyUtils OSX packages

MalwareTechyutilsditekSHen detectionBSD 2-Clause LicenseCompiles with YARA-X
Author
ditekSHen
Date
2020-11-06
Modified
2024-11-01
Score / Quality
75 / 73

What this rule detects

Detects TechyUtils OSX packages

Associated malware family: Techyutils.

It defines 8 patterns (8 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
malware-osx-techyutils.yarBSD 2-Clause License
rule DITEKSHEN_MALWARE_Osx_Techyutils : FILE
{
	meta:
		description = "Detects TechyUtils OSX packages"
		author = "ditekSHen"
		id = "59fd4165-987f-5b68-9341-d78184b25a1c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3208-L3224"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "071c67cace09dd66233bd4c4dd78c32d0f39f7e38dc06ec62e09fef67762d098"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Osx.Trojan.TechyUtils"

	strings:
		$s1 = "__ZL58__arclite_NSMutableDictionary__" ascii
		$s2 = "__ZL46__arclite_NSDictionary_" ascii
		$s3 = "<key>com.apple.security.get-task-allow</key>" fullword ascii
		$s4 = "/productprice.svc/GetCountryCode" ascii
		$s5 = "@_pthread_mutex_lock" fullword ascii
		$s6 = "_mh_execute_header" fullword ascii
		$s7 = "/Users/prasoon/Documents/" ascii
		$developerid = "Developer ID Application: Techyutils Software Private Limited (VS9Q8BRRRJ)" ascii

	condition:
		uint16( 0 ) == 0xfacf and ( all of ( $s* ) or $developerid )
}

Strings (8 patterns)

IdentifierTypeValueModifiers
$s1text"__ZL58__arclite_NSMutableDictionary__"ascii
$s2text"__ZL46__arclite_NSDictionary_"ascii
$s3text"<key>com.apple.security.get-task-allow</key>"fullword ascii
$s4text"/productprice.svc/GetCountryCode"ascii
$s5text"@_pthread_mutex_lock"fullword ascii
$s6text"_mh_execute_header"fullword ascii
$s7text"/Users/prasoon/Documents/"ascii
$developeridtext"Developer ID Application: Techyutils Software Private Limited (VS9Q8BRRRJ)"ascii

Condition

uint16( 0 ) == 0xfacf and ( all of ( $s* ) or $developerid )

In plain words (Heuristic)

  • All patterns in ( $s* ) must match.
  • Pattern $developerid must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: ditekSHen

Source repository: ditekSHen detection @ e76c93dcde

Licence: BSD 2-Clause License (repository licence)

Copyright notice: Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 59fd4165-987f-5b68-9341-d78184b25a1c

Metadata

clamav_sigMALWARE.Osx.Trojan.TechyUtils

Tags:FILE

Related rules