YARA · ESET malware-ioc

ESET_Sparklinggoblin_Mutex

SparklingGoblin ChaCha20 loaders mutexes

GenericESET malware-iocBSD 2-Clause LicenseCompiles with YARA-X

Author: ESET Research
Date: 2021-05-20
Modified: 2021-08-26
Score / Quality: 75 / 80

What this rule detects

SparklingGoblin ChaCha20 loaders mutexes

It defines 2 patterns (2 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

sparklinggoblin-mutex.yarBSD 2-Clause License

rule ESET_Sparklinggoblin_Mutex
{
	meta:
		description = "SparklingGoblin ChaCha20 loaders mutexes"
		author = "ESET Research"
		id = "e33d2bc1-29d6-5117-8e0f-31f8bced0979"
		date = "2021-05-20"
		modified = "2021-08-26"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/sparklinggoblin/SparklingGoblin.yar#L465-L489"
		license_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE"
		hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b"
		hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f"
		hash = "8be6d5f040d0085c62b1459afc627707b0de89cf"
		hash = "4668302969fe122874fb2447a80378dcb671c86b"
		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
		logic_hash = "00fbd514c8e2d6dea3b0f175e857a613e158b64caf1f970e814d62f1ebe9d35c"
		score = 75
		quality = 80
		tags = ""
		license = "BSD 2-Clause"

	strings:
		$mutex_1 = "kREwdFrOlvASgP4zWZyV89m6T2K0bIno"
		$mutex_2 = "v5EPQFOImpTLaGZes3Nl1JSKHku8AyCw"

	condition:
		any of them
}

Strings (2 patterns)

Identifier	Type	Value	Modifiers
$mutex_1	text	"kREwdFrOlvASgP4zWZyV89m6T2K0bIno"
$mutex_2	text	"v5EPQFOImpTLaGZes3Nl1JSKHku8AyCw"

Condition

any of them

In plain words (Heuristic)

At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/eset/malware-ioc/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

2edbea43f5c40c867e5b6bbd93cc972525df598b
b6d245d3d49b06645c0578804064ce0c072cbe0f
8be6d5f040d0085c62b1459afc627707b0de89cf
4668302969fe122874fb2447a80378dcb671c86b
9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b
9ce7650f2c08c391a35d69956e171932d116b8bd

Licence & attribution

Author: ESET Research

Source repository: ESET malware-ioc @ 17baf44964

Licence: BSD 2-Clause License (stated in the rule's own meta)

“BSD 2-Clause”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: e33d2bc1-29d6-5117-8e0f-31f8bced0979

ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023
MalwareESET malware-ioc· ESET Research· 2023-03-31
ESET_Cw_Windows_Redline_Panel_Distinctive_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Prompts
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Status_Message_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Tab_Headers
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Apt_Windows_Invisimole
APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
ESET_Apt_Windows_Invisimole_CPL_Loader
APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
ESET_Apt_Windows_Invisimole_DNS_Downloader
APT / threat actorESET malware-ioc· ESET Research· 2021-05-17