Skip to content
yararules.org
Menu

YARA · Embee Research

EMBEERESEARCH_Win_Darkgate_Xllloader_Oct_2023

Detects XLL Files Related to DarkGate

GenericEmbee ResearchDetection Rule License 1.1Compiles with YARA-X
Author
Matthew @ Embee_Research
Date
2023-10-03
Modified
2023-10-04
Score / Quality
75 / 75

What this rule detects

Detects XLL Files Related to DarkGate

It defines 2 patterns (1 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
win-darkgate-xllloader-oct-2023.yarDetection Rule License 1.1
rule EMBEERESEARCH_Win_Darkgate_Xllloader_Oct_2023
{
	meta:
		description = "Detects XLL Files Related to DarkGate"
		author = "Matthew @ Embee_Research"
		id = "4b5d9a2d-90ee-5452-83be-1677e1888045"
		date = "2023-10-03"
		modified = "2023-10-04"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_darkgate_xll_loader_oct_2023.yar#L2-L23"
		license_url = "N/A"
		hash = "091b7c16791cf976e684fe22ee18a4099a4e26ec75fa145b85dd14603b466b00"
		hash = "305de78353b0d599cd40a73c7e639df7f5946d1fc36691c8f7798a99ee6835e7"
		hash = "98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f"
		hash = "27ec297e1fc34e29963303782ff881e74f8bd4126f4c5be0c4754f745d85f79a"
		hash = "392fd4d218a8e333bc422635e48fdfae59054413c7a6be764c0275752d45ab23"
		hash = "9a34b32d0a66dd4f59aeea82ef48f335913c47c6ca901ab109df702cd166892f"
		logic_hash = "ea9a166550c53225b0a06e2cd86760f63aed8973e889a457470bdba3d87ce6af"
		score = 75
		quality = 75
		tags = ""

	strings:
		$s1 = "xlAutoOpen" wide ascii
		$s2 = { 49 ?? ?? 4c ?? ?? 48 ?? ?? 48 ?? ?? 02 e8 ?? ?? ?? ?? 48 ?? ?? 31 ?? 48 ?? ?? 01 48 ?? ?? 41 ?? ?? ?? ?? 30 ?? 48 ?? ?? 01 49 ?? ?? 75 ?? }

	condition:
		( all of ( $s* ) )
}

Strings (2 patterns)

IdentifierTypeValueModifiers
$s1text"xlAutoOpen"wide ascii
$s2hex{ 49 ?? ?? 4c ?? ?? 48 ?? ?? 48 ?? ?? 02 e8 ?? ?? ?? ?? 48 ?? ?? 31 ?? 48 ?? ?? 01 48 ?? ?? 41 ?? ?? ?? ?? 30 ?? 48 ?? ?? 01 49 ?? ?? 75 ?? }

Condition

( all of ( $s* ) )

In plain words (Heuristic)

  • All patterns in ( $s* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 091b7c16791cf976e684fe22ee18a4099a4e26ec75fa145b85dd14603b466b00
  • 305de78353b0d599cd40a73c7e639df7f5946d1fc36691c8f7798a99ee6835e7
  • 98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
  • 27ec297e1fc34e29963303782ff881e74f8bd4126f4c5be0c4754f745d85f79a
  • 392fd4d218a8e333bc422635e48fdfae59054413c7a6be764c0275752d45ab23
  • 9a34b32d0a66dd4f59aeea82ef48f335913c47c6ca901ab109df702cd166892f

Licence & attribution

Author: Matthew @ Embee_Research

Source repository: Embee Research @ ac56d6f6fd

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 4b5d9a2d-90ee-5452-83be-1677e1888045

Related rules