YARA · ESET malware-ioc

ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023

Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12

MalwareIconic StealerESET malware-iocBSD 2-Clause LicenseCompiles with YARA-X

Author: ESET Research
Date: 2023-03-31
Modified: 2023-04-19
Score / Quality: 75 / 80

What this rule detects

Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12

Associated malware family: Iconic Stealer.

Targets: Windows PE.

It has no patterns: the condition alone decides (modules, file properties or other rules). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

richheaders-lazarus-nukesped-iconicpayloads-3cx-q12023.yarBSD 2-Clause License

import "pe"

rule ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023
{
	meta:
		description = "Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12"
		author = "ESET Research"
		id = "5c815d14-8a3e-5c6a-9dc3-988e0f31c094"
		date = "2023-03-31"
		modified = "2023-04-19"
		reference = "https://github.com/eset/malware-ioc"
		source_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/nukesped_lazarus/rich_headers_IconicPayloads_3CX.yar#L6-L23"
		license_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE"
		hash = "3b88cda62cdd918b62ef5aa8c5a73a46f176d18b"
		hash = "cad1120d91b812acafef7175f949dd1b09c6c21a"
		hash = "5b03294b72c0caa5fb20e7817002c600645eb475"
		hash = "7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec"
		logic_hash = "f11a1db798bfcc534982bdf6afaae154b095b6a1e0896e75e2791c01e51a1c16"
		score = 75
		quality = 80
		tags = ""

	condition:
		pe.rich_signature.toolid( 259 , 30818 ) == 9 and pe.rich_signature.toolid ( 256 , 31329 ) == 1 and pe.rich_signature.toolid ( 261 , 30818 ) >= 30 and pe.rich_signature.toolid ( 261 , 30818 ) <= 38 and pe.rich_signature.toolid ( 261 , 29395 ) >= 134 and pe.rich_signature.toolid ( 261 , 29395 ) <= 164 and pe.rich_signature.toolid ( 257 , 29395 ) >= 6 and pe.rich_signature.toolid ( 257 , 29395 ) <= 14
}

Condition

pe.rich_signature.toolid( 259 , 30818 ) == 9 and pe.rich_signature.toolid ( 256 , 31329 ) == 1 and pe.rich_signature.toolid ( 261 , 30818 ) >= 30 and pe.rich_signature.toolid ( 261 , 30818 ) <= 38 and pe.rich_signature.toolid ( 261 , 29395 ) >= 134 and pe.rich_signature.toolid ( 261 , 29395 ) <= 164 and pe.rich_signature.toolid ( 257 , 29395 ) >= 6 and pe.rich_signature.toolid ( 257 , 29395 ) <= 14

In plain words (Heuristic)

Uses the pe module.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/eset/malware-ioc

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

3b88cda62cdd918b62ef5aa8c5a73a46f176d18b
cad1120d91b812acafef7175f949dd1b09c6c21a
5b03294b72c0caa5fb20e7817002c600645eb475
7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec

Licence & attribution

Author: ESET Research

Source repository: ESET malware-ioc @ 17baf44964

Licence: BSD 2-Clause License (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 5c815d14-8a3e-5c6a-9dc3-988e0f31c094

MALPEDIA_Win_Iconic_Stealer_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
VOLEXITY_Apt_Win_Iconicstealer
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-03-30
ESET_Cw_Windows_Redline_Panel_Distinctive_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Prompts
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Status_Message_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Tab_Headers
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_IIS_Group04_Rgdoor
MalwareESET malware-ioc· ESET Research· 2021-08-04

More Iconic Stealer rules