YARA · ESET malware-ioc

ESET_Apt_Windows_TA410_Flowcloud_Fcclientdll_Strings

Strings found in fcClientDll/responsor.dat module.

APT / threat actorESET malware-iocBSD 2-Clause LicenseCompiles with YARA-X

Author: ESET Research
Date: 2021-10-12
Modified: 2022-04-27
Score / Quality: 75 / 80

What this rule detects

Strings found in fcClientDll/responsor.dat module.

Targets: Windows PE.

It defines 14 patterns (14 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-windows-ta410-flowcloud-fcclientdll-strings.yarBSD 2-Clause License

rule ESET_Apt_Windows_TA410_Flowcloud_Fcclientdll_Strings : FILE
{
	meta:
		description = "Strings found in fcClientDll/responsor.dat module."
		author = "ESET Research"
		id = "80ecaf51-406f-590c-8f9c-59672683de02"
		date = "2021-10-12"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/ta410/ta410.yar#L641-L669"
		license_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE"
		logic_hash = "3a93f58cf14b57a96157077ec14aa6fb181e3da80f4ba46c0379a58b67c08a0e"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"

	strings:
		$s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
		$s2 = "Cookie: COOKIE_SUPPORT=true; JSESSIONID=5C7E7A60D01D2891F40648DAB6CB3DF4.jvm1; COMPANY_ID=10301; ID=666e7375545678695645673d; PASSWORD=7a4b48574d746470447a303d; LOGIN=6863303130; SCREEN_NAME=4a2b455377766b657451493d; GUEST_LANGUAGE_ID=en-US"
		$fc_msg = ".fc_net.msg"
		$s4 = "\\pipe\\namedpipe_keymousespy_english" wide
		$s5 = "8932910381748^&*^$58876$%^ghjfgsa413901280dfjslajflsdka&*(^7867=89^&*F(^&*5678f5ds765f76%&*%&*5"
		$s6 = "cls_{CACB140B-0B82-4340-9B05-7983017BA3A4}" wide
		$s7 = "HTTP/1.1 200 OK\x0d\nServer: Apache-Coyote/1.1\x0d\nPragma: No-cache\x0d\nCache-Control: no-cache\x0d\nExpires: Thu, 01 Jan 1970 08:00:00 CST\x0d\nLast-Modified: Fri, 27 Apr 2012 08:11:04 GMT\x0d\nContent-Type: application/xml\x0d\nContent-Length: %d\x0d\nDate: %s GMT"
		$sql1 = "create table if not exists table_filed_space"
		$sql2 = "create table if not exists clipboard"
		$sql3 = "create trigger if not exists file_after_delete after delete on file"
		$sql4 = "create trigger if not exists file_data_after_insert after insert on file_data"
		$sql5 = "create trigger if not exists file_data_after_delete after delete on file_data"
		$sql6 = "create trigger if not exists file_data_after_update after update on file_data"
		$sql7 = "insert into file_data(file_id, ofs, data, status)"

	condition:
		uint16( 0 ) == 0x5a4d and ( any of ( $s* ) or #fc_msg >= 8 or 4 of ( $sql* ) )
}

Strings (14 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
$s2	text	"Cookie: COOKIE_SUPPORT=true; JSESSIONID=5C7E7A60D01D2891F40648DAB6CB3DF4.jvm1; COMPANY_ID=10301; ID=666e7375545678695645673d; PASSWORD=7a4b48574d746470447a303d …
$fc_msg	text	".fc_net.msg"
$s4	text	"\\pipe\\namedpipe_keymousespy_english"	wide
$s5	text	"8932910381748^&^$58876$%^ghjfgsa413901280dfjslajflsdka&(^7867=89^&F(^&5678f5ds765f76%&%&5"
$s6	text	"cls_{CACB140B-0B82-4340-9B05-7983017BA3A4}"	wide
$s7	text	"HTTP/1.1 200 OK\x0d\nServer: Apache-Coyote/1.1\x0d\nPragma: No-cache\x0d\nCache-Control: no-cache\x0d\nExpires: Thu, 01 Jan 1970 08:00:00 CST\x0d\nLast-Modifie …
$sql1	text	"create table if not exists table_filed_space"
$sql2	text	"create table if not exists clipboard"
$sql3	text	"create trigger if not exists file_after_delete after delete on file"
$sql4	text	"create trigger if not exists file_data_after_insert after insert on file_data"
$sql5	text	"create trigger if not exists file_data_after_delete after delete on file_data"
$sql6	text	"create trigger if not exists file_data_after_update after update on file_data"
$sql7	text	"insert into file_data(file_id, ofs, data, status)"

Condition

uint16( 0 ) == 0x5a4d and ( any of ( $s* ) or #fc_msg >= 8 or 4 of ( $sql* ) )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
At least one pattern in ( $s* ) must match.
At least 4 patterns in ( $sql* ) must match.
Pattern $fc_msg must occur >= 8 times.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/eset/malware-ioc/

Licence & attribution

Author: ESET Research

Source repository: ESET malware-ioc @ 17baf44964

Licence: BSD 2-Clause License (stated in the rule's own meta)

“BSD 2-Clause”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 80ecaf51-406f-590c-8f9c-59672683de02

Metadata

version	1

Tags:FILE

ESET_Apt_Windows_Invisimole
APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
ESET_Apt_Windows_Invisimole_CPL_Loader
APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
ESET_Apt_Windows_Invisimole_DNS_Downloader
APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
ESET_Apt_Windows_Invisimole_Logs
APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
ESET_Apt_Windows_Invisimole_SFX_Dropper
APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
ESET_Apt_Windows_TA410_Lookback_Decryption
APT / threat actorESET malware-ioc· ESET Research· 2021-10-12
ESET_Apt_Windows_TA410_Lookback_HTTP
APT / threat actorESET malware-ioc· ESET Research· 2021-10-12
ESET_Apt_Windows_TA410_Lookback_Loader
APT / threat actorESET malware-ioc· ESET Research· 2021-10-12