YARA · SEKOIA.IO Community

SEKOIA_Apt_Blackwood_Nspx30_Plugin

Detects plugins of NSPX30 backdoor based on RTTI and rundll32 string

APT / threat actorNspx30SEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X (with warnings)

Author: Sekoia.io
Date: 2024-01-29
Modified: 2024-12-19
Score / Quality: 75 / 76

What this rule detects

Detects plugins of NSPX30 backdoor based on RTTI and rundll32 string

Associated malware family: Nspx30.

Targets: Windows PE.

It defines 3 patterns (1 text, 2 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-blackwood-nspx30-plugin.yarDetection Rule License 1.1

rule SEKOIA_Apt_Blackwood_Nspx30_Plugin : FILE
{
	meta:
		description = "Detects plugins of NSPX30 backdoor based on RTTI and rundll32 string"
		author = "Sekoia.io"
		id = "ef8e0d51-c78c-426b-8008-910e27546f23"
		date = "2024-01-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_blackwood_nspx30_plugin.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "cf7c232a5a817ff5c0da04744abf99ed2fcea587e3e6f6e8bf3aef7ca8f2b51b"
		score = 75
		quality = 76
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = {2E 3F 41 56 43 43 61 62 69 6E 65 74 40 40}
		$s2 = {2E 3F 41 56 43 45 6E 63 6F 64 65 72 40 40}
		$s3 = "rundll32.exe \"%hs\",#1" wide

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 1MB and all of them
}

Strings (3 patterns)

Identifier	Type	Value	Modifiers
$s1	hex	{2E 3F 41 56 43 43 61 62 69 6E 65 74 40 40}
$s2	hex	{2E 3F 41 56 43 45 6E 63 6F 64 65 72 40 40}
$s3	text	"rundll32.exe \"%hs\",#1"	wide

Condition

uint16be( 0 ) == 0x4d5a and filesize < 1MB and all of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 1MB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/SEKOIA-IO/Community

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: ef8e0d51-c78c-426b-8008-910e27546f23

Metadata

version	1.0
classification	TLP:CLEAR

Tags:FILE

MALPEDIA_Win_Nspx30_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SEKOIA_Apt_Gobrat_2
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
SEKOIA_Apt_Icepeony_Icecache
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
SEKOIA_Apt_Icepeony_Iceevent
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
SEKOIA_Apt_Kimsuky_Fpspy
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Klogexe
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Powershell
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
SEKOIA_Apt_Kimsuky_Powershell_Dropper_Strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11