YARA · SEKOIA.IO Community

SEKOIA_Apt_Toneshell_Loader

Detects loader of ToneShell (exception based)

APT / threat actorSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X

Author: Sekoia.io
Date: 2024-10-02
Modified: 2024-12-19
Score / Quality: 75 / 80

What this rule detects

Detects loader of ToneShell (exception based)

Targets: Windows PE.

It defines 5 patterns (3 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-toneshell-loader.yarDetection Rule License 1.1

rule SEKOIA_Apt_Toneshell_Loader : FILE
{
	meta:
		description = "Detects loader of ToneShell (exception based)"
		author = "Sekoia.io"
		id = "b4bf284b-cab6-455e-a1c1-ad341d43bfdd"
		date = "2024-10-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_toneshell_loader.yar#L1-L40"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "41e0d172d900344a3692b88fff7527d9"
		hash = "782cf7183735935f3f7aad041cec3184"
		hash = "97c1f436028c58b51d4c92ee9c9ce424"
		hash = "d6c771f2afd8ce35e8727f95f3a3c6c4"
		hash = "b8520c5bad88ade394086cb7b1b7b631"
		hash = "0b3e8571e70a32490da19f6b3283151c"
		hash = "f6784c65ee115a9ae4c0fb03e0045285"
		hash = "38888696e5223c77f5f8680922396123"
		hash = "b52d0707e4e5d5c0d5fd5f5a177ba712"
		hash = "fd54c6d17ff91640b377ff41353efdaa"
		hash = "a6efe263acc794a212647a96e52ddf1f"
		hash = "6e8c80c5f2f9a1da504618e984d2a56c"
		hash = "0839666697ccc562a9c1fe77d6755931"
		hash = "f367f2fe580e556176b60da202c742a5"
		hash = "e8b2fcc14494ada2f28d1f6ecd2521a2"
		hash = "c08589e10812cc7d636dcbe2a36d43b4"
		hash = "fa848a05cfecc0c25cd21364c9516584"
		hash = "be231f7879d8d2159b67b7f277527268"
		hash = "2acd8b48202dcc30d88a871370c4f37a"
		hash = "72963bfc2837695f038680471d4f061c"
		logic_hash = "40e1b918a4d83a4918260d8b1cc56e5097665a366f94bd5068e4ae519e3a681b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$exception = {00 00 00 00 2e 44 00 00}
		$code = {02 00 00 00 66 89 96}
		$kernel32 = "Kernel32.dll" wide
		$outputdbgstr = "OutputDebugStringA"
		$content = "ResetEvent"

	condition:
		uint16be( 0 ) == 0x4d5a and all of them and filesize < 2MB
}

Strings (5 patterns)

Identifier	Type	Value	Modifiers
$exception	hex	{00 00 00 00 2e 44 00 00}
$code	hex	{02 00 00 00 66 89 96}
$kernel32	text	"Kernel32.dll"	wide
$outputdbgstr	text	"OutputDebugStringA"
$content	text	"ResetEvent"

Condition

uint16be( 0 ) == 0x4d5a and all of them and filesize < 2MB

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 2MB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/SEKOIA-IO/Community

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

41e0d172d900344a3692b88fff7527d9
782cf7183735935f3f7aad041cec3184
97c1f436028c58b51d4c92ee9c9ce424
d6c771f2afd8ce35e8727f95f3a3c6c4
b8520c5bad88ade394086cb7b1b7b631
0b3e8571e70a32490da19f6b3283151c
f6784c65ee115a9ae4c0fb03e0045285
38888696e5223c77f5f8680922396123
b52d0707e4e5d5c0d5fd5f5a177ba712
fd54c6d17ff91640b377ff41353efdaa
a6efe263acc794a212647a96e52ddf1f
6e8c80c5f2f9a1da504618e984d2a56c
0839666697ccc562a9c1fe77d6755931
f367f2fe580e556176b60da202c742a5
e8b2fcc14494ada2f28d1f6ecd2521a2
c08589e10812cc7d636dcbe2a36d43b4
fa848a05cfecc0c25cd21364c9516584
be231f7879d8d2159b67b7f277527268
2acd8b48202dcc30d88a871370c4f37a
72963bfc2837695f038680471d4f061c

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: b4bf284b-cab6-455e-a1c1-ad341d43bfdd

Metadata

version	1.0
classification	TLP:CLEAR

Tags:FILE

SEKOIA_Apt_Gobrat_2
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
SEKOIA_Apt_Icepeony_Icecache
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
SEKOIA_Apt_Icepeony_Iceevent
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
SEKOIA_Apt_Kimsuky_Fpspy
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Klogexe
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Powershell
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
SEKOIA_Apt_Kimsuky_Powershell_Dropper_Strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
SEKOIA_Apt_Kimsuky_Toddlershark_Obfuscated
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06