YARA · SEKOIA.IO Community

SEKOIA_Apt_Kimsuky_Powershell

Powershell scripts used by Kimsuky. If size < 3KB ok. If between 3 and 15, a check is needed

APT / threat actorKimsukySEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X

Author: Sekoia.io
Date: 2024-09-23
Modified: 2024-12-19
Score / Quality: 75 / 80

What this rule detects

Powershell scripts used by Kimsuky. If size < 3KB ok. If between 3 and 15, a check is needed

Associated malware family: Kimsuky.

It defines 2 patterns (2 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-kimsuky-powershell.yarDetection Rule License 1.1

rule SEKOIA_Apt_Kimsuky_Powershell : FILE
{
	meta:
		description = "Powershell scripts used by Kimsuky. If size < 3KB ok. If between 3 and 15, a check is needed"
		author = "Sekoia.io"
		id = "b7f812e0-d08b-40fe-908a-dc5765d6bc66"
		date = "2024-09-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_kimsuky_powershell.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "6babb53d881448dc58dd7c32fcd4208a"
		hash = "29ec7a4495ea512d44d33c9847893200"
		hash = "fde68771cebd7ecd81721b0dff5b7869"
		hash = "0c3fd7f45688d5ddb9f0107877ce2fbd"
		hash = "1a1723be720c1d9cd57cf4a6a112df79"
		logic_hash = "7436d8cba8a8caaf95786c38c4ceee4426dc7e36ae3eeed5d3162310cd76091d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = ".ToCharArray();[array]::Reverse(" ascii
		$ = ");$res = -join ($bytes -as [char[]]);Invoke-Expression $res;" ascii

	condition:
		all of them and filesize < 15KB
}

Strings (2 patterns)

Identifier	Type	Value	Modifiers
$	text	".ToCharArray();[array]::Reverse("	ascii
$	text	");$res = -join ($bytes -as [char[]]);Invoke-Expression $res;"	ascii

Condition

all of them and filesize < 15KB

In plain words (Heuristic)

The file must be smaller than 15KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/SEKOIA-IO/Community

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

6babb53d881448dc58dd7c32fcd4208a
29ec7a4495ea512d44d33c9847893200
fde68771cebd7ecd81721b0dff5b7869
0c3fd7f45688d5ddb9f0107877ce2fbd
1a1723be720c1d9cd57cf4a6a112df79

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: b7f812e0-d08b-40fe-908a-dc5765d6bc66

Metadata

version	1.0
classification	TLP:CLEAR

Tags:FILE

SEKOIA_Apt_Kimsuky_Fpspy
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Klogexe
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Powershell_Dropper_Strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
SEKOIA_Apt_Kimsuky_Toddlershark_Obfuscated
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06
SEKOIA_Apt_Kimsuky_Toddlershark_Strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06
SEKOIA_Apt_Kimsuky_Validator_Strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
SEKOIA_Apt_Kimsuky_Vbs
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
SEKOIA_Apt_Kimsuky_Malicious_Gotopwsh_Lnk
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-09-11

More Kimsuky rules