YARA · Mandiant red team tool countermeasures

FIREEYE_RT_Methodology_OLE_CHARENCODING_2

Looking for suspicious char encoding

Suspicious / huntingMandiant red team tool countermeasuresBSD 2-Clause LicenseCompiles with YARA-X

Author: FireEye
Date: 2020-12-08
Modified: 2020-12-09
Score / Quality: 65 / 75

What this rule detects

Looking for suspicious char encoding

Targets: OLE / legacy Office.

It defines 9 patterns (9 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

methodology-ole-charencoding-2.yarBSD 2-Clause License

rule FIREEYE_RT_Methodology_OLE_CHARENCODING_2 : FILE
{
	meta:
		description = "Looking for suspicious char encoding"
		author = "FireEye"
		id = "7abd1a11-7a55-50ac-aa6b-537e7c59a5ab"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/supplemental/yara/Methodology_OLE_CHARENCODING_2.yar#L4-L23"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "41b70737fa8dda75d5e95c82699c2e9b"
		logic_hash = "20843295531dfd88934fe0902a5101c5c0828e82df3289d7f263f16df9c92324"
		score = 65
		quality = 75
		tags = "FILE"
		rev = 4

	strings:
		$echo1 = "101;99;104;111;32;111;102;102;" ascii wide
		$echo2 = "101:99:104:111:32:111:102:102:" ascii wide
		$echo3 = "101x99x104x111x32x111x102x102x" ascii wide
		$pe1 = "77;90;144;" ascii wide
		$pe2 = "77:90:144:" ascii wide
		$pe3 = "77x90x144x" ascii wide
		$pk1 = "80;75;3;4;" ascii wide
		$pk2 = "80:75:3:4:" ascii wide
		$pk3 = "80x75x3x4x" ascii wide

	condition:
		( uint32( 0 ) == 0xe011cfd0 ) and filesize < 10MB and any of them
}

Strings (9 patterns)

Identifier	Type	Value	Modifiers
$echo1	text	"101;99;104;111;32;111;102;102;"	ascii wide
$echo2	text	"101:99:104:111:32:111:102:102:"	ascii wide
$echo3	text	"101x99x104x111x32x111x102x102x"	ascii wide
$pe1	text	"77;90;144;"	ascii wide
$pe2	text	"77:90:144:"	ascii wide
$pe3	text	"77x90x144x"	ascii wide
$pk1	text	"80;75;3;4;"	ascii wide
$pk2	text	"80:75:3:4:"	ascii wide
$pk3	text	"80x75x3x4x"	ascii wide

Condition

( uint32( 0 ) == 0xe011cfd0 ) and filesize < 10MB and any of them

In plain words (Heuristic)

The file must start with the OLE header — legacy Office documents, MSI.
The file must be smaller than 10MB (a cheap guard that skips large files).
At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/mandiant/red_team_tool_countermeasures/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

41b70737fa8dda75d5e95c82699c2e9b

Licence & attribution

Author: FireEye

Source repository: Mandiant red team tool countermeasures @ 3561b71724

Licence: BSD 2-Clause License (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 7abd1a11-7a55-50ac-aa6b-537e7c59a5ab

Metadata

rev	4

Tags:FILE

FIREEYE_RT_APT_Backdoor_Macos_GORAT_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-08
FIREEYE_RT_APT_Backdoor_Win_GORAT_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-08
FIREEYE_RT_APT_Backdoor_Win_GORAT_5
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-02
FIREEYE_RT_APT_Builder_PY_MATRYOSHKA_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-02
FIREEYE_RT_APT_Builder_PY_REDFLARE_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-11-27
FIREEYE_RT_APT_Builder_Win64_MATRYOSHKA_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-02
FIREEYE_RT_APT_Controller_Linux_REDFLARE_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-02
FIREEYE_RT_APT_Downloader_Win32_REDFLARE_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-11-27