YARA · SEKOIA.IO Community
SEKOIA_Apt_Kimsuky_Toddlershark_Obfuscated
Detects obfuscated version of Kimsuky TODDLERSHARK vbs malware
- Author
- Sekoia.io
- Date
- 2024-03-06
- Modified
- 2024-12-19
- Score / Quality
- 75 / 80
What this rule detects
Detects obfuscated version of Kimsuky TODDLERSHARK vbs malware
Associated malware family: Kimsuky.
It defines 4 patterns (1 text, 3 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
apt-kimsuky-toddlershark-obfuscated.yarDetection Rule License 1.1
rule SEKOIA_Apt_Kimsuky_Toddlershark_Obfuscated : FILE
{
meta:
= "Detects obfuscated version of Kimsuky TODDLERSHARK vbs malware"
= "Sekoia.io"
= "9ab82466-4f38-4597-b75b-13252e180c70"
= "2024-03-06"
= "2024-12-19"
= "https://github.com/SEKOIA-IO/Community"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_kimsuky_toddlershark_obfuscated.yar#L1-L18"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
= "5f067ce32e7fee5cf481d82bb98f4ae10bd7187078bc111b08fc58d043954152"
= 75
= 80
= "FILE"
= "1.0"
= "TLP:CLEAR"
strings:
$s1 = { 3a 20 [3-10] 20 3d 20 22 [3-30] 22 3a }
$s2 = { 45 78 65 63 75 74 65 28 [3-15] 28 22 }
$s3 = { 50 72 69 76 61 74 65 20 46 75 6e 63 74 69 6f 6e 20 [3-15] 28 42 79 56 61 6c 20 [3-15] 29 3a }
$s4 = "& Chr(\"&H\" & Mid("
condition:
#s4== 1 and #s3 == 1 and #s2 == 1 and #s1 > 20 and filesize < 1MB
}
Strings (4 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $s1 | hex | { 3a 20 [3-10] 20 3d 20 22 [3-30] 22 3a } | |
| $s2 | hex | { 45 78 65 63 75 74 65 28 [3-15] 28 22 } | |
| $s3 | hex | { 50 72 69 76 61 74 65 20 46 75 6e 63 74 69 6f 6e 20 [3-15] 28 42 79 56 61 6c 20 [3-15] 29 3a } | |
| $s4 | text | "& Chr(\"&H\" & Mid(" |
Condition
#s4== 1 and #s3 == 1 and #s2 == 1 and #s1 > 20 and filesize < 1MBIn plain words (Heuristic)
- The file must be smaller than 1MB (a cheap guard that skips large files).
- Pattern $s4 must occur == 1 times.
- Pattern $s3 must occur == 1 times.
- Pattern $s2 must occur == 1 times.
- Pattern $s1 must occur > 20 times.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Licence & attribution
Author: Sekoia.io
Source repository: SEKOIA.IO Community @ a438a5901a
Licence: Detection Rule License 1.1 (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 9ab82466-4f38-4597-b75b-13252e180c70
Metadata
| version | 1.0 |
|---|---|
| classification | TLP:CLEAR |
Tags:FILE
Related rules
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-09-11