YARA · SEKOIA.IO Community

SEKOIA_Apt_Gamaredon_Gammaload_Maliciouslnk

Detects Gamaredon's GammaLoad LNK

APT / threat actorSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X

Author: Sekoia.io
Date: 2022-08-01
Modified: 2024-12-19
Score / Quality: 75 / 80

What this rule detects

Detects Gamaredon's GammaLoad LNK

It defines 2 patterns (1 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-gamaredon-gammaload-maliciouslnk.yarDetection Rule License 1.1

rule SEKOIA_Apt_Gamaredon_Gammaload_Maliciouslnk : FILE
{
	meta:
		description = "Detects Gamaredon's GammaLoad LNK"
		author = "Sekoia.io"
		id = "2612e6c6-0bda-4bfa-a840-aa0a0b4c945b"
		date = "2022-08-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_gamaredon_gammaload_maliciouslnk.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "94ba156cd6697a9999b6a4f78c4356ea3382b7b3e7a1af79d488aa34df2c3b40"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$mshta = "System32\\mshta.exe"
		$trait = { 0D 0A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0D 0A }

	condition:
		uint32be( 0 ) == 0x4c000000 and #trait > 100 and $mshta and filesize > 100KB and filesize < 300KB
}

Strings (2 patterns)

Identifier	Type	Value	Modifiers
$mshta	text	"System32\\mshta.exe"
$trait	hex	{ 0D 0A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0D 0A }

Condition

uint32be( 0 ) == 0x4c000000 and #trait > 100 and $mshta and filesize > 100KB and filesize < 300KB

In plain words (Heuristic)

The file must start with the Windows shortcut (LNK) header.
The file must be smaller than 300KB (a cheap guard that skips large files).
The file must be larger than 100KB.
Pattern $trait must occur > 100 times.
Pattern $mshta must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/SEKOIA-IO/Community

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 2612e6c6-0bda-4bfa-a840-aa0a0b4c945b

Metadata

version	1.0
classification	TLP:CLEAR

Tags:FILE

SEKOIA_Apt_Gobrat_2
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
SEKOIA_Apt_Icepeony_Icecache
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
SEKOIA_Apt_Icepeony_Iceevent
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
SEKOIA_Apt_Kimsuky_Fpspy
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Klogexe
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Powershell
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
SEKOIA_Apt_Kimsuky_Powershell_Dropper_Strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
SEKOIA_Apt_Kimsuky_Toddlershark_Obfuscated
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06