YARA · ESET malware-ioc

ESET_IIS_Group07_Iispy

Detects Group 7 native IIS malware family (IISpy)

MalwareIispyESET malware-iocBSD 2-Clause LicenseCompiles with YARA-X

Author: ESET Research
Date: 2021-08-04
Score / Quality: 75 / 80

What this rule detects

Detects Group 7 native IIS malware family (IISpy)

Associated malware family: Iispy.

It defines 15 patterns (13 text, 2 hex, 0 regex). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports and 1 rule(s) it depends on needed to compile it on its own.

iis-group07-iispy.yarBSD 2-Clause License

import "pe"

private rule ESET_IIS_Native_Module_PRIVATE : FILE
{
	meta:
		description = "Signature to match an IIS native module (clean or malicious)"
		author = "ESET Research"
		id = "e3bacdc8-fde1-5e83-ac94-79fc345e888d"
		date = "2021-08-04"
		modified = "2021-08-04"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/badiis/badiis.yar#L34-L92"
		license_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE"
		logic_hash = "5a388dc3253df606e2648d1f9c018e6dde373bbddce66dba69b7aecdd95bac18"
		score = 75
		quality = 55
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"

	strings:
		$e1 = "This module subscribed to event"
		$e2 = "CHttpModule::OnBeginRequest"
		$e3 = "CHttpModule::OnPostBeginRequest"
		$e4 = "CHttpModule::OnAuthenticateRequest"
		$e5 = "CHttpModule::OnPostAuthenticateRequest"
		$e6 = "CHttpModule::OnAuthorizeRequest"
		$e7 = "CHttpModule::OnPostAuthorizeRequest"
		$e8 = "CHttpModule::OnResolveRequestCache"
		$e9 = "CHttpModule::OnPostResolveRequestCache"
		$e10 = "CHttpModule::OnMapRequestHandler"
		$e11 = "CHttpModule::OnPostMapRequestHandler"
		$e12 = "CHttpModule::OnAcquireRequestState"
		$e13 = "CHttpModule::OnPostAcquireRequestState"
		$e14 = "CHttpModule::OnPreExecuteRequestHandler"
		$e15 = "CHttpModule::OnPostPreExecuteRequestHandler"
		$e16 = "CHttpModule::OnExecuteRequestHandler"
		$e17 = "CHttpModule::OnPostExecuteRequestHandler"
		$e18 = "CHttpModule::OnReleaseRequestState"
		$e19 = "CHttpModule::OnPostReleaseRequestState"
		$e20 = "CHttpModule::OnUpdateRequestCache"
		$e21 = "CHttpModule::OnPostUpdateRequestCache"
		$e22 = "CHttpModule::OnLogRequest"
		$e23 = "CHttpModule::OnPostLogRequest"
		$e24 = "CHttpModule::OnEndRequest"
		$e25 = "CHttpModule::OnPostEndRequest"
		$e26 = "CHttpModule::OnSendResponse"
		$e27 = "CHttpModule::OnMapPath"
		$e28 = "CHttpModule::OnReadEntity"
		$e29 = "CHttpModule::OnCustomRequestNotification"
		$e30 = "CHttpModule::OnAsyncCompletion"
		$e31 = "CGlobalModule::OnGlobalStopListening"
		$e32 = "CGlobalModule::OnGlobalCacheCleanup"
		$e33 = "CGlobalModule::OnGlobalCacheOperation"
		$e34 = "CGlobalModule::OnGlobalHealthCheck"
		$e35 = "CGlobalModule::OnGlobalConfigurationChange"
		$e36 = "CGlobalModule::OnGlobalFileChange"
		$e37 = "CGlobalModule::OnGlobalApplicationStart"
		$e38 = "CGlobalModule::OnGlobalApplicationResolveModules"
		$e39 = "CGlobalModule::OnGlobalApplicationStop"
		$e40 = "CGlobalModule::OnGlobalRSCAQuery"
		$e41 = "CGlobalModule::OnGlobalTraceEvent"
		$e42 = "CGlobalModule::OnGlobalCustomNotification"
		$e43 = "CGlobalModule::OnGlobalThreadCleanup"
		$e44 = "CGlobalModule::OnGlobalApplicationPreload"

	condition:
		uint16( 0 ) == 0x5A4D and pe.exports ( "RegisterModule" ) and any of ( $e* )
}

rule ESET_IIS_Group07_Iispy
{
	meta:
		description = "Detects Group 7 native IIS malware family (IISpy)"
		author = "ESET Research"
		id = "64ed0189-a0be-5592-b9c6-1622700a7ed7"
		date = "2021-08-04"
		modified = "2021-08-04"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/badiis/badiis.yar#L261-L296"
		license_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE"
		logic_hash = "ec5db5f36d06f9b0bdfe598fc72431da35afc1473dcc29f437a0f48ea9835a03"
		score = 75
		quality = 80
		tags = ""
		license = "BSD 2-Clause"
		version = "1"

	strings:
		$s1 = "/credential/username"
		$s2 = "/credential/password"
		$s3 = "/computer/domain"
		$s4 = "/computer/name"
		$s5 = "/password"
		$s6 = "/cmd"
		$s7 = "%.8s%.8s=%.8s%.16s%.8s%.16s"
		$s8 = "ImpersonateLoggedOnUser"
		$s9 = "WNetAddConnection2W"
		$t1 = "X-Forwarded-Proto"
		$t2 = "Sec-Fetch-Mode"
		$t3 = "Sec-Fetch-Site"
		$t4 = "Cookie"
		$t5 = {49 45 4E 44 AE 42 60 82}
		$t6 = {89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52}

	condition:
		ESET_IIS_Native_Module_PRIVATE and 2 of ( $s* ) and any of ( $t* )
}

Strings (15 patterns)

Identifier	Type	Value
$s1	text	"/credential/username"
$s2	text	"/credential/password"
$s3	text	"/computer/domain"
$s4	text	"/computer/name"
$s5	text	"/password"
$s6	text	"/cmd"
$s7	text	"%.8s%.8s=%.8s%.16s%.8s%.16s"
$s8	text	"ImpersonateLoggedOnUser"
$s9	text	"WNetAddConnection2W"
$t1	text	"X-Forwarded-Proto"
$t2	text	"Sec-Fetch-Mode"
$t3	text	"Sec-Fetch-Site"
$t4	text	"Cookie"
$t5	hex	{49 45 4E 44 AE 42 60 82}
$t6	hex	{89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52}

Condition

ESET_IIS_Native_Module_PRIVATE and 2 of ( $s* ) and any of ( $t* )

In plain words (Heuristic)

At least one pattern in ( $t* ) must match.
At least 2 patterns in ( $s* ) must match.
Depends on the rule ESET_IIS_Native_Module_PRIVATE.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/eset/malware-ioc/

Licence & attribution

Author: ESET Research

Source repository: ESET malware-ioc @ 17baf44964

Licence: BSD 2-Clause License (stated in the rule's own meta)

“BSD 2-Clause”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 64ed0189-a0be-5592-b9c6-1622700a7ed7

Metadata

version	1

MALPEDIA_Win_Iispy_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023
MalwareESET malware-ioc· ESET Research· 2023-03-31
ESET_Cw_Windows_Redline_Panel_Distinctive_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Prompts
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Status_Message_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Tab_Headers
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_IIS_Group04_Rgdoor
MalwareESET malware-ioc· ESET Research· 2021-08-04
ESET_Invisimole_Blob_PRIVATE
MalwareESET malware-ioc· ESET Research· 2021-05-17