Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_Backdoor_Win_Gorat_Memory_1

Identifies GoRat malware in memory based on strings.

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X (with warnings)
Author
FireEye
Date
2020-12-08
Modified
2025-02-12
Score / Quality
75 / 85

What this rule detects

Identifies GoRat malware in memory based on strings.

It defines 12 patterns (12 text, 0 hex, 0 regex).

YARA-X says: warning[duplicate_pattern_value]: duplicate pattern value

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
apt-backdoor-win-gorat-memory-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_Backdoor_Win_Gorat_Memory_1
{
	meta:
		description = "Identifies GoRat malware in memory based on strings."
		author = "FireEye"
		id = "4fcdd98f-1873-58e1-a9f5-73ee0aa5a69f"
		date = "2020-12-08"
		modified = "2025-02-12"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L1013-L1039"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "3b926b5762e13ceec7ac3a61e85c93bb"
		logic_hash = "bf8d80b7a7d35c1bcb353ff66d10bc95c2e6502043acc6554887465a467cdcf7"
		score = 75
		quality = 85
		tags = ""

	strings:
		$rat1 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
		$rat2 = "rat.(*Core).generateBeacon" fullword
		$rat3 = "rat.gJitter" fullword
		$rat4 = "rat/comms.(*protectedChannel).SendCmdResponse" fullword
		$rat5 = "rat/modules/filemgmt.(*acquire).NewCommandExecution" fullword
		$rat6 = "rat/modules/latlisten.(*latlistensrv).handleCmd" fullword
		$rat7 = "rat/modules/netsweeper.(*netsweeperRunner).runSweep" fullword
		$rat8 = "rat/modules/netsweeper.(*Pinger).listen" fullword
		$rat9 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
		$rat10 = "rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction" fullword
		$rat11 = "rat/platforms/win/modules/namedpipe.(*dummy).Open" fullword
		$winblows = "rat/platforms/win.(*winblows).GetStage" fullword

	condition:
		$winblows or 3 of ( $rat* )
}

Strings (12 patterns)

IdentifierTypeValueModifiers
$rat1text"rat/modules/socks.(*HTTPProxyClient).beacon"fullword
$rat2text"rat.(*Core).generateBeacon"fullword
$rat3text"rat.gJitter"fullword
$rat4text"rat/comms.(*protectedChannel).SendCmdResponse"fullword
$rat5text"rat/modules/filemgmt.(*acquire).NewCommandExecution"fullword
$rat6text"rat/modules/latlisten.(*latlistensrv).handleCmd"fullword
$rat7text"rat/modules/netsweeper.(*netsweeperRunner).runSweep"fullword
$rat8text"rat/modules/netsweeper.(*Pinger).listen"fullword
$rat9text"rat/modules/socks.(*HTTPProxyClient).beacon"fullword
$rat10text"rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction"fullword
$rat11text"rat/platforms/win/modules/namedpipe.(*dummy).Open"fullword
$winblowstext"rat/platforms/win.(*winblows).GetStage"fullword

Condition

$winblows or 3 of ( $rat* )

In plain words (Heuristic)

  • At least 3 patterns in ( $rat* ) must match.
  • Pattern $winblows must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 3b926b5762e13ceec7ac3a61e85c93bb

Licence & attribution

Author: FireEye

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 4fcdd98f-1873-58e1-a9f5-73ee0aa5a69f

Related rules