Skip to content
yararules.org
Menu

YARA · Embee Research

EMBEERESEARCH_Win_Agent_Tesla_Bytecodes_Sep_2023

No description has been set in the source file - EmbeeResearch

MalwareAgentteslaEmbee ResearchDetection Rule License 1.1Compiles with YARA-X
Author
Matthew @embee_research
Date
2023-09-21
Score / Quality
75 / 75

What this rule detects

No description has been set in the source file - EmbeeResearch

Associated malware family: Agenttesla.

Targets: .NET assembly.

It defines 1 patterns (0 text, 1 hex, 0 regex). YARA modules used: dotnet.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

win-agent-tesla-bytecodes-sep-2023.yarDetection Rule License 1.1
import "dotnet"

rule EMBEERESEARCH_Win_Agent_Tesla_Bytecodes_Sep_2023
{
	meta:
		description = "No description has been set in the source file - EmbeeResearch"
		author = "Matthew @embee_research"
		id = "9d1c5010-7c64-5a6a-bf60-35c042732761"
		date = "2023-09-21"
		modified = "2023-09-21"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_agent_tesla_bytecodes_sep_2023.yar#L4-L21"
		license_url = "N/A"
		hash = "ce696cf7a6111f5e7c6781854de04ddc262b6c9b39c059fd5435dfb3b8901f04"
		hash = "afc29232c4989587db2c54b7c9f145fd0d73537e045ece15338582ede5389fce"
		hash = "fba4374163ba25c9dc572f1a5d7f3e46e09531ab964d808f3dde2a19c05a2ee5"
		logic_hash = "1cc40ab16dfa5245b3146e4512509037f540d59e155040a2336a97cd0f42e612"
		score = 75
		quality = 75
		tags = ""

	strings:
		$s1 = {8F ?? ?? ?? ?? 25 47 FE ?? ?? ?? FE ?? ?? ?? 91 61 D2 52 20 ?? ?? ?? ?? FE ?? ?? ?? }

	condition:
		dotnet.is_dotnet and $s1
}

Strings (1 patterns)

IdentifierTypeValueModifiers
$s1hex{8F ?? ?? ?? ?? 25 47 FE ?? ?? ?? FE ?? ?? ?? 91 61 D2 52 20 ?? ?? ?? ?? FE ?? ?? ?? }

Condition

dotnet.is_dotnet and $s1

In plain words (Heuristic)

  • Uses the dotnet module.
  • Pattern $s1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • ce696cf7a6111f5e7c6781854de04ddc262b6c9b39c059fd5435dfb3b8901f04
  • afc29232c4989587db2c54b7c9f145fd0d73537e045ece15338582ede5389fce
  • fba4374163ba25c9dc572f1a5d7f3e46e09531ab964d808f3dde2a19c05a2ee5

Licence & attribution

Author: Matthew @embee_research

Source repository: Embee Research @ ac56d6f6fd

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 9d1c5010-7c64-5a6a-bf60-35c042732761

Related rules

More Agenttesla rules