Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_Builder_PY_REDFLARE_2_1

No description has been set in the source file - Signature Base

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
FireEye
Date
2020-12-01
Score / Quality
75 / 85

What this rule detects

No description has been set in the source file - Signature Base

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
apt-builder-py-redflare-2-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_Builder_PY_REDFLARE_2_1
{
	meta:
		description = "No description has been set in the source file - Signature Base"
		author = "FireEye"
		id = "74c56ee1-734e-5fdb-beee-6345a5993f68"
		date = "2020-12-01"
		modified = "2020-12-01"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L1376-L1391"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "4410e95de247d7f1ab649aa640ee86fb"
		logic_hash = "0f28fb23c0c1d589466c7c541c8dc588b038d02dded0c66c4a448d1f768c95c5"
		score = 75
		quality = 85
		tags = ""

	strings:
		$s1 = "<510sxxII"
		$s2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
		$s3 = "parsePluginOutput"

	condition:
		all of them and #s2 == 2
}

Strings (3 patterns)

IdentifierTypeValueModifiers
$s1text"<510sxxII"
$s2text"0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
$s3text"parsePluginOutput"

Condition

all of them and #s2 == 2

In plain words (Heuristic)

  • All patterns in the rule must match.
  • Pattern $s2 must occur == 2 times.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 4410e95de247d7f1ab649aa640ee86fb

Licence & attribution

Author: FireEye

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 74c56ee1-734e-5fdb-beee-6345a5993f68

Related rules