Skip to content
yararules.org
Menu

YARA · SEKOIA.IO Community

SEKOIA_Tool_Xiebroc2_Strings

Detects XiebroC2 based on strings

Hack toolSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X
Author
Sekoia.io
Date
2024-09-11
Modified
2024-12-19
Score / Quality
75 / 80

What this rule detects

Detects XiebroC2 based on strings

It defines 9 patterns (9 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
tool-xiebroc2-strings.yarDetection Rule License 1.1
rule SEKOIA_Tool_Xiebroc2_Strings
{
	meta:
		description = "Detects XiebroC2 based on strings"
		author = "Sekoia.io"
		id = "8451878e-5371-440b-b8ac-f9e6f7643d3c"
		date = "2024-09-11"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_xiebroc2_strings.yar#L1-L40"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "84e665bcbf963a2cf67d879aa3422d79"
		hash = "3558c376420724694ba244a2e2acd20c"
		hash = "e29fb9cd825db51a7a2e519f188e61ba"
		hash = "a3b31739ad5eed51277c8478a83160a3"
		hash = "d6e2499ea7fe8f047da1a95dae16d2c3"
		hash = "1616818b65bf49d985bb1816461a4a75"
		hash = "2e72d3ef2492088a4623d77d5e419ab8"
		hash = "351770f860507d652ec3644ed1988f7f"
		hash = "58fa6ad96028753ba8b0b0ed8fa6dccb"
		hash = "607b541525b27eeefbef1455397bff35"
		hash = "c2a242612468814e2e951e4db3762059"
		hash = "431e275f4e43ec4ef7c2cc8ba126e9d3"
		hash = "ace54bd32c226a7b9a6d4d53791e4021"
		hash = "f22c21ed7bba1ddfc42ffdc66da3a4dd"
		hash = "9a5ff9e07ed04cb0e71102cf1aae380c"
		hash = "d20e01a1af3f40a7a9646d7e7df1b42e"
		hash = "5544b621c9772cd32c4db77a0e59515a"
		logic_hash = "f3be31e0f1ad8e8bce132d861de5068340653547d786378f9b8045382f40939f"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "RemarkClientColor"
		$s2 = "HandlePacket"
		$s3 = "-hide"
		$s4 = "Failed to send data:"
		$s5 = "Pac_ket"
		$s6 = "WANip"
		$s7 = "%s %s && Kernel: %s"
		$g1 = "go.buildid"
		$g2 = "dep    golang.org"

	condition:
		3 of ( $s* ) and any of ( $g* )
}

Strings (9 patterns)

IdentifierTypeValueModifiers
$s1text"RemarkClientColor"
$s2text"HandlePacket"
$s3text"-hide"
$s4text"Failed to send data:"
$s5text"Pac_ket"
$s6text"WANip"
$s7text"%s %s && Kernel: %s"
$g1text"go.buildid"
$g2text"dep golang.org"

Condition

3 of ( $s* ) and any of ( $g* )

In plain words (Heuristic)

  • At least one pattern in ( $g* ) must match.
  • At least 3 patterns in ( $s* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 84e665bcbf963a2cf67d879aa3422d79
  • 3558c376420724694ba244a2e2acd20c
  • e29fb9cd825db51a7a2e519f188e61ba
  • a3b31739ad5eed51277c8478a83160a3
  • d6e2499ea7fe8f047da1a95dae16d2c3
  • 1616818b65bf49d985bb1816461a4a75
  • 2e72d3ef2492088a4623d77d5e419ab8
  • 351770f860507d652ec3644ed1988f7f
  • 58fa6ad96028753ba8b0b0ed8fa6dccb
  • 607b541525b27eeefbef1455397bff35
  • c2a242612468814e2e951e4db3762059
  • 431e275f4e43ec4ef7c2cc8ba126e9d3
  • ace54bd32c226a7b9a6d4d53791e4021
  • f22c21ed7bba1ddfc42ffdc66da3a4dd
  • 9a5ff9e07ed04cb0e71102cf1aae380c
  • d20e01a1af3f40a7a9646d7e7df1b42e
  • 5544b621c9772cd32c4db77a0e59515a

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 8451878e-5371-440b-b8ac-f9e6f7643d3c

Metadata

version1.0
classificationTLP:CLEAR

Related rules