Skip to content
yararules.org
Menu

YARA · SEKOIA.IO Community

SEKOIA_Dropper_Mac_Lazarus_Manuscrypt

MacOS Manuscrypt dropped by TraderTraitor

MalwareSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X
Author
Sekoia.io
Date
2022-04-19
Modified
2024-12-19
Score / Quality
75 / 80

What this rule detects

MacOS Manuscrypt dropped by TraderTraitor

Targets: macOS Mach-O.

It defines 4 patterns (4 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
dropper-mac-lazarus-manuscrypt.yarDetection Rule License 1.1
rule SEKOIA_Dropper_Mac_Lazarus_Manuscrypt : FILE
{
	meta:
		description = "MacOS Manuscrypt dropped by TraderTraitor"
		author = "Sekoia.io"
		id = "6138bd0c-1fcf-4586-b2b6-29955c7d6266"
		date = "2022-04-19"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/dropper_mac_lazarus_manuscrypt.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156"
		hash = "9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa"
		logic_hash = "dbe75a34f91906fc275c04af0fc068923993bab37a7574b3fe38733d87f31835"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "networksetup -getwebproxy '%s'" ascii
		$ = "Cookie: _ga=%s%02d%d%d%02d%s" ascii
		$ = "networksetup -listallnetworkservices" ascii
		$ = "gid=%s%02d%d%03d%s" ascii

	condition:
		uint32( 0 ) == 0xFEEDFACF and all of them
}

Strings (4 patterns)

IdentifierTypeValueModifiers
$text"networksetup -getwebproxy '%s'"ascii
$text"Cookie: _ga=%s%02d%d%d%02d%s"ascii
$text"networksetup -listallnetworkservices"ascii
$text"gid=%s%02d%d%03d%s"ascii

Condition

uint32( 0 ) == 0xFEEDFACF and all of them

In plain words (Heuristic)

  • The file must start with a Mach-O / fat binary magic — a macOS executable.
  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156
  • 9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 6138bd0c-1fcf-4586-b2b6-29955c7d6266

Metadata

version1.0
classificationTLP:CLEAR

Tags:FILE

Related rules