Skip to content
yararules.org
Menu

YARA · SEKOIA.IO Community

SEKOIA_Tool_Win_Lightrail

Detect the LIGHTRAIL tunneler used by UNC1549

Hack toolLightrailSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X
Author
Sekoia.io
Date
2024-02-29
Modified
2024-12-19
Score / Quality
75 / 80

What this rule detects

Detect the LIGHTRAIL tunneler used by UNC1549

Associated malware family: Lightrail.

Targets: Windows PE.

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
tool-win-lightrail.yarDetection Rule License 1.1
rule SEKOIA_Tool_Win_Lightrail : FILE
{
	meta:
		description = "Detect the LIGHTRAIL tunneler used by UNC1549"
		author = "Sekoia.io"
		id = "39259f2c-11fe-4edd-8a9e-f36920132272"
		date = "2024-02-29"
		modified = "2024-12-19"
		reference = "https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_win_lightrail.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "e7ddab967b0487827db069833221aa2fe4ca05f7cda976cbc528ecb306a22774"
		hash = "4ecd511d9654f7fd66a61eb4ab6d7153040b5092d1594ff39935f01fbdbd4914"
		hash = "3472bc8ed6182eb17811c97ada7ebd48034ad09b6a7062b341fe09818d7a309f"
		hash = "ec7b97092278123f0c0613c5f9252eeccf55265d4aa5f2cfed57a63ebf3530ac"
		hash = "8f3757b8f5888a1303af71cbc1a106927d3d6c45552ee192c3ed0347804c2194"
		hash = "8b47b5ed1ed7afcc9194e1350d4e1996bd91ca3204747b586f309f4609a1a4cc"
		logic_hash = "84491bf7e955930c04e96f63ffb8c8f35ad02d9a917eceb727bf87c9ed3d831e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "lastenzug.dll"
		$s2 = "Lastenzug.dll"
		$azure = ".cloudapp.azure.com" wide

	condition:
		uint16be( 0 ) == 0x4d5a and 1 of ( $s* ) and $azure
}

Strings (3 patterns)

IdentifierTypeValueModifiers
$s1text"lastenzug.dll"
$s2text"Lastenzug.dll"
$azuretext".cloudapp.azure.com"wide

Condition

uint16be( 0 ) == 0x4d5a and 1 of ( $s* ) and $azure

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 1 patterns in ( $s* ) must match.
  • Pattern $azure must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • e7ddab967b0487827db069833221aa2fe4ca05f7cda976cbc528ecb306a22774
  • 4ecd511d9654f7fd66a61eb4ab6d7153040b5092d1594ff39935f01fbdbd4914
  • 3472bc8ed6182eb17811c97ada7ebd48034ad09b6a7062b341fe09818d7a309f
  • ec7b97092278123f0c0613c5f9252eeccf55265d4aa5f2cfed57a63ebf3530ac
  • 8f3757b8f5888a1303af71cbc1a106927d3d6c45552ee192c3ed0347804c2194
  • 8b47b5ed1ed7afcc9194e1350d4e1996bd91ca3204747b586f309f4609a1a4cc

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 39259f2c-11fe-4edd-8a9e-f36920132272

Metadata

version1.0
classificationTLP:CLEAR

Tags:FILE

Related rules