YARA · SEKOIA.IO Community
SEKOIA_Apt_Lazarus_Dangerouspassword_Lnk
Detects Lazarus DangerousPassword LNKs
- Author
- Sekoia.io
- Date
- 2022-07-26
- Modified
- 2024-12-19
- Score / Quality
- 75 / 80
What this rule detects
Detects Lazarus DangerousPassword LNKs
It defines 5 patterns (0 text, 5 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
apt-lazarus-dangerouspassword-lnk.yarDetection Rule License 1.1
rule SEKOIA_Apt_Lazarus_Dangerouspassword_Lnk : FILE
{
meta:
= "Detects Lazarus DangerousPassword LNKs"
= "Sekoia.io"
= "32533880-7f75-4682-a7ae-9868d0b5174b"
= "2022-07-26"
= "2024-12-19"
= "https://github.com/SEKOIA-IO/Community"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_lazarus_dangerouspassword_lnk.yar#L1-L21"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
= "79731450c4623f614c55d8c08d879579e21fd38c85d2a288724b6e9470de6e29"
= 75
= 80
= "FILE"
= "1.0"
= "TLP:CLEAR"
strings:
$s1 = {6D 00 73 00 68 00 2A}
$s2 = {25 00 70 00 75 00 62 00 6C 00 69 00 63 00 25}
$s3 = {44 00 4F 00 20 00 73 00 74 00 61 00 72 00 74}
$b1 = {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2F 00 62 00 20 00 6D 00 73 00 68 00 74 00 61}
$c1 = {68 00 74 00 74 00 70 00 73 00 3A 00 2F 00 2F 00 62 00 69 00 74 00 2E 00 6C 00 79 00 2F}
condition:
uint32be( 0 ) == 0x4C000000 and filesize > 1KB and filesize < 40MB and ( all of ( $s* ) or $b1 or ( $s1 and $c1 ) )
}
Strings (5 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $s1 | hex | {6D 00 73 00 68 00 2A} | |
| $s2 | hex | {25 00 70 00 75 00 62 00 6C 00 69 00 63 00 25} | |
| $s3 | hex | {44 00 4F 00 20 00 73 00 74 00 61 00 72 00 74} | |
| $b1 | hex | {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2F 00 62 00 20 00 6D 00 73 00 68 00 74 00 61} | |
| $c1 | hex | {68 00 74 00 74 00 70 00 73 00 3A 00 2F 00 2F 00 62 00 69 00 74 00 2E 00 6C 00 79 00 2F} |
Condition
uint32be( 0 ) == 0x4C000000 and filesize > 1KB and filesize < 40MB and ( all of ( $s* ) or $b1 or ( $s1 and $c1 ) )In plain words (Heuristic)
- The file must start with the Windows shortcut (LNK) header.
- The file must be smaller than 40MB (a cheap guard that skips large files).
- The file must be larger than 1KB.
- All patterns in ( $s* ) must match.
- Pattern $b1 must be present.
- Pattern $s1 must be present.
- Pattern $c1 must be present.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Licence & attribution
Author: Sekoia.io
Source repository: SEKOIA.IO Community @ a438a5901a
Licence: Detection Rule License 1.1 (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 32533880-7f75-4682-a7ae-9868d0b5174b
Metadata
| version | 1.0 |
|---|---|
| classification | TLP:CLEAR |
Tags:FILE
Related rules
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06