Skip to content
yararules.org
Menu

YARA · ditekSHen detection

DITEKSHEN_MALWARE_Win_Margulasrat

Detects MargulasRAT

MalwareMargulasratditekSHen detectionBSD 2-Clause LicenseCompiles with YARA-X
Author
ditekSHen
Date
2020-11-06
Modified
2024-11-01
Score / Quality
75 / 75

What this rule detects

Detects MargulasRAT

Associated malware family: Margulasrat.

Targets: Windows PE.

It defines 17 patterns (16 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
malware-win-margulasrat.yarBSD 2-Clause License
rule DITEKSHEN_MALWARE_Win_Margulasrat : FILE
{
	meta:
		description = "Detects MargulasRAT"
		author = "ditekSHen"
		id = "6efabf80-9194-542d-afd2-9bf9c8e26e55"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6786-L6810"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "dd5b94c947d97cdc34032f2cb84b4975a1e8f510638857fb6dbe553bcff7d16e"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$pdb1 = "G:\\VP-S-Fin\\memory\\" ascii
		$pdb2 = "G:\\VP-S-Fin\\Margulas\\" ascii
		$pdb3 = "G:\\VP-S-Fin\\remote" ascii
		$pdb4 = "G:\\VP-S-Fin\\" ascii
		$s1 = "/C choice /C Y /N /D Y /T 1 & Del " fullword wide
		$s2 = "strToHash" fullword ascii
		$s3 = "\\socking" fullword wide
		$s4 = "\\wininets" fullword wide
		$s5 = "ClientSocket" fullword ascii
		$s6 = "new Stream()" fullword wide
		$s7 = "CipherText" fullword ascii
		$s8 = "WriteAllBytes" fullword ascii
		$s9 = { 00 50 72 6f 63 65 73 73 00 45 78 69 73 74 73 00}
		$s10 = "pxR/THCwdLuruMmw8wB8xAUvbno1yPGBTOV9IoOkAp/n7+paQm74pkzlfSKDpAKfTOV9IoOkAp9M5X0ig6QCn0zlfSKDpAKfTOV9IoOkAp" wide
		$c1 = "149.248.52.61" wide
		$c2 = "://vpn.nic.in" wide
		$c3 = "://www.mod.gov.in/dod/sites/default/files/" wide

	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and ( 1 of ( $c* ) or 3 of ( $s* ) ) ) or ( 1 of ( $c* ) and 3 of ( $s* ) ) or ( 6 of ( $s* ) ) )
}

Strings (17 patterns)

IdentifierTypeValueModifiers
$pdb1text"G:\\VP-S-Fin\\memory\\"ascii
$pdb2text"G:\\VP-S-Fin\\Margulas\\"ascii
$pdb3text"G:\\VP-S-Fin\\remote"ascii
$pdb4text"G:\\VP-S-Fin\\"ascii
$s1text"/C choice /C Y /N /D Y /T 1 & Del "fullword wide
$s2text"strToHash"fullword ascii
$s3text"\\socking"fullword wide
$s4text"\\wininets"fullword wide
$s5text"ClientSocket"fullword ascii
$s6text"new Stream()"fullword wide
$s7text"CipherText"fullword ascii
$s8text"WriteAllBytes"fullword ascii
$s9hex{ 00 50 72 6f 63 65 73 73 00 45 78 69 73 74 73 00}
$s10text"pxR/THCwdLuruMmw8wB8xAUvbno1yPGBTOV9IoOkAp/n7+paQm74pkzlfSKDpAKfTOV9IoOkAp9M5X0ig6QCn0zlfSKDpAKfTOV9IoOkAp"wide
$c1text"149.248.52.61"wide
$c2text"://vpn.nic.in"wide
$c3text"://www.mod.gov.in/dod/sites/default/files/"wide

Condition

uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and ( 1 of ( $c* ) or 3 of ( $s* ) ) ) or ( 1 of ( $c* ) and 3 of ( $s* ) ) or ( 6 of ( $s* ) ) )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 1 patterns in ( $pdb* ) must match.
  • At least 1 patterns in ( $c* ) must match.
  • At least 3 patterns in ( $s* ) must match.
  • At least 6 patterns in ( $s* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: ditekSHen

Source repository: ditekSHen detection @ e76c93dcde

Licence: BSD 2-Clause License (repository licence)

Copyright notice: Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 6efabf80-9194-542d-afd2-9bf9c8e26e55

Tags:FILE

Related rules