YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_APT29_NOBELIUM_Nativezone_Loader_May21_1

Detects NativeZone loader as described in APT29 NOBELIUM report

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2021-05-27
Modified: 2025-03-21
Score / Quality: 85 / 85

What this rule detects

Detects NativeZone loader as described in APT29 NOBELIUM report

Targets: Windows PE.

It defines 6 patterns (3 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-apt29-nobelium-nativezone-loader-may21-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Nativezone_Loader_May21_1 : FILE
{
	meta:
		description = "Detects NativeZone loader as described in APT29 NOBELIUM report"
		author = "Florian Roth (Nextron Systems)"
		id = "02d9257d-f439-5071-96b0-a973b088e329"
		date = "2021-05-27"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L184-L204"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
		logic_hash = "a02fd6fcd7423781bbd2e4458bd61d28e16a5b1a73b1682e63db5c86d53c7da4"
		score = 85
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "\\SystemCertificates\\Lib\\CertPKIProvider.dll" ascii
		$s2 = "rundll32.exe %s %s" ascii fullword
		$s3 = "eglGetConfigs" ascii fullword
		$op1 = { 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 33 db 89 5d fc }
		$op2 = { 8b 46 18 e9 30 ff ff ff 90 87 2f 00 10 90 2f 00 10 }
		$op3 = { e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 3 of them or 4 of them
}

Strings (6 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"\\SystemCertificates\\Lib\\CertPKIProvider.dll"	ascii
$s2	text	"rundll32.exe %s %s"	ascii fullword
$s3	text	"eglGetConfigs"	ascii fullword
$op1	hex	{ 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 33 db 89 5d fc }
$op2	hex	{ 8b 46 18 e9 30 ff ff ff 90 87 2f 00 10 90 2f 00 10 }
$op3	hex	{ e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }

Condition

uint16( 0 ) == 0x5a4d and filesize < 3000KB and 3 of them or 4 of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 3000KB (a cheap guard that skips large files).
At least 3 patterns in the rule must match.
At least 4 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 02d9257d-f439-5071-96b0-a973b088e329

Tags:FILE

SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24