YARA · SEKOIA.IO Community

SEKOIA_Apt_Mustangpanda_Maliciousdll_Loading_Plugx_Strings

Detects MustangPanda malicious DLL

APT / threat actorPlugxSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X

Author: Sekoia.io
Date: 2023-12-18
Modified: 2024-12-19
Score / Quality: 75 / 80

What this rule detects

Detects MustangPanda malicious DLL

Associated malware family: Plugx.

Targets: Windows PE.

It defines 5 patterns (5 text, 0 hex, 0 regex). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

apt-mustangpanda-maliciousdll-loading-plugx-strings.yarDetection Rule License 1.1

import "pe"

rule SEKOIA_Apt_Mustangpanda_Maliciousdll_Loading_Plugx_Strings
{
	meta:
		description = "Detects MustangPanda malicious DLL"
		author = "Sekoia.io"
		id = "2296ac6e-63f5-4cff-aeb7-2c5205e6f559"
		date = "2023-12-18"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_mustangpanda_maliciousdll_loading_plugx_strings.yar#L3-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "651c096cf7043a01d939dff9ba58e4d69f15b2244c71b43bedb4ada8c37e8859"
		logic_hash = "667901d36585248a891b90ff8ed7006030151fbbbe0d4a85570944a94edba7f8"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "VirtualAlloc"
		$ = "VirtualFree"
		$ = "VirtualProtect"
		$ = "VirtualQuery"
		$ = "GCC: (MinGW-W64"

	condition:
		pe.exports( "MsiProvideQualifiedComponentW" ) and all of them
}

Strings (5 patterns)

Identifier	Type	Value
$	text	"VirtualAlloc"
$	text	"VirtualFree"
$	text	"VirtualProtect"
$	text	"VirtualQuery"
$	text	"GCC: (MinGW-W64"

Condition

pe.exports( "MsiProvideQualifiedComponentW" ) and all of them

In plain words (Heuristic)

All patterns in the rule must match.
Uses the pe module.
Checks exported functions or the DLL name.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/SEKOIA-IO/Community

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

651c096cf7043a01d939dff9ba58e4d69f15b2244c71b43bedb4ada8c37e8859

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 2296ac6e-63f5-4cff-aeb7-2c5205e6f559

Metadata

version	1.0
classification	TLP:CLEAR

SEKOIA_Plugx_Final_Payload
MalwareSEKOIA.IO Community· Sekoia.io· 2023-07-04
MALPEDIA_Win_Plugx_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
ARKBIRD_SOLG_Mal_Plugx_Thor_July_2021_1Metadata only
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-27
SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23Metadata only
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23Metadata only
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23Metadata only
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
SEKOIA_Apt_Gobrat_2
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
SEKOIA_Apt_Icepeony_Icecache
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21

More Plugx rules