Skip to content
yararules.org
Menu

YARA · ditekSHen detection

DITEKSHEN_MALWARE_Win_Deeprats

Detects DeepRats (

MalwareDeepratsditekSHen detectionBSD 2-Clause LicenseCompiles with YARA-X
Author
ditekSHen
Date
2020-11-06
Modified
2024-11-01
Score / Quality
75 / 73

What this rule detects

Detects DeepRats (

Associated malware family: Deeprats.

Targets: Windows PE.

It defines 22 patterns (22 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
malware-win-deeprats.yarBSD 2-Clause License
rule DITEKSHEN_MALWARE_Win_Deeprats : FILE
{
	meta:
		description = "Detects DeepRats ("
		author = "ditekSHen"
		id = "5b774e24-3864-519f-9cfd-d729d7d567a0"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7188-L7218"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		hash = "1f8b7e1b14869d119c5de1f05330094899bd997fca4c322d852db85cbd9271e6"
		logic_hash = "511264c0b6932f90069a5206cd142ca7210b0bc40c51ef5aa9c41a161fb57aab"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$s1 = "https://freegeoip.live/json/https://myexternalip.com/rawin" ascii
		$s2 = "github.com/cretz/bine" ascii
		$s3 = "github.com/kbinani/screenshot" ascii
		$s4 = "socks5://%s:%d" ascii
		$s5 = "socks5://%s:%s@%s:%d" ascii
		$s6 = "http://%s:%d" ascii
		$s7 = "http://%s@%s:%d" ascii
		$s8 = "%SystemRoot%\\system32\\--CookieAuthentication" ascii
		$s9 = "tor_addr_" ascii
		$f1 = ".GetVnc" ascii
		$f2 = ".GetCommand" ascii
		$f3 = ".GetPayload" ascii
		$f4 = ".ListenCommands" ascii
		$f5 = ".ReceiveFile" ascii
		$f6 = ".RegisterImplant" ascii
		$f7 = ".Screenshot" ascii
		$f8 = ".SendFile" ascii
		$f9 = ".StartShell" ascii
		$f10 = ".UnregisterImplant" ascii
		$f11 = ".VncInstalled" ascii
		$f12 = ".PingPong" ascii
		$f13 = ".ListenCMD" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or 8 of ( $f* ) )
}

Strings (22 patterns)

IdentifierTypeValueModifiers
$s1text"https://freegeoip.live/json/https://myexternalip.com/rawin"ascii
$s2text"github.com/cretz/bine"ascii
$s3text"github.com/kbinani/screenshot"ascii
$s4text"socks5://%s:%d"ascii
$s5text"socks5://%s:%s@%s:%d"ascii
$s6text"http://%s:%d"ascii
$s7text"http://%s@%s:%d"ascii
$s8text"%SystemRoot%\\system32\\--CookieAuthentication"ascii
$s9text"tor_addr_"ascii
$f1text".GetVnc"ascii
$f2text".GetCommand"ascii
$f3text".GetPayload"ascii
$f4text".ListenCommands"ascii
$f5text".ReceiveFile"ascii
$f6text".RegisterImplant"ascii
$f7text".Screenshot"ascii
$f8text".SendFile"ascii
$f9text".StartShell"ascii
$f10text".UnregisterImplant"ascii
$f11text".VncInstalled"ascii
$f12text".PingPong"ascii
$f13text".ListenCMD"ascii

Condition

uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or 8 of ( $f* ) )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 7 patterns in ( $s* ) must match.
  • At least 8 patterns in ( $f* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 1f8b7e1b14869d119c5de1f05330094899bd997fca4c322d852db85cbd9271e6

Licence & attribution

Author: ditekSHen

Source repository: ditekSHen detection @ e76c93dcde

Licence: BSD 2-Clause License (repository licence)

Copyright notice: Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 5b774e24-3864-519f-9cfd-d729d7d567a0

Tags:FILE

Related rules