Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_CN_Group_Loader_Jan20_1

Detects loaders used by Chinese groups

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Vitali Kremez
Date
2020-02-01
Modified
2025-08-11
Score / Quality
80 / 85

What this rule detects

Detects loaders used by Chinese groups

It defines 1 patterns (0 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
apt-cn-group-loader-jan20-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_CN_Group_Loader_Jan20_1
{
	meta:
		description = "Detects loaders used by Chinese groups"
		author = "Vitali Kremez"
		id = "c85ae499-4f76-56ff-877d-887e1a7fc077"
		date = "2020-02-01"
		modified = "2025-08-11"
		reference = "https://twitter.com/VK_Intel/status/1223411369367785472?s=20"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L271-L283"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "30a180ada2390ca8df4bf7883624a5a176249622b4c34ce96931fe62b09ea8e3"
		score = 80
		quality = 85
		tags = ""

	strings:
		$xc1 = { 8B C3 C1 E3 10 C1 E8 10 03 D8 6B DB 77 83 C3 13 }

	condition:
		1 of them
}

Strings (1 patterns)

IdentifierTypeValueModifiers
$xc1hex{ 8B C3 C1 E3 10 C1 E8 10 03 D8 6B DB 77 83 C3 13 }

Condition

1 of them

In plain words (Heuristic)

  • At least 1 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Vitali Kremez

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: c85ae499-4f76-56ff-877d-887e1a7fc077