YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1

Detects Red Delta samples

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2020-10-14
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects Red Delta samples

Targets: Windows PE.

It defines 9 patterns (7 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-cn-mal-reddelta-shellcode-loader-oct20-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1 : FILE
{
	meta:
		description = "Detects Red Delta samples"
		author = "Florian Roth (Nextron Systems)"
		id = "47417488-e843-5346-9baa-fcce30b884d1"
		date = "2020-10-14"
		modified = "2023-12-05"
		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_reddelta.yar#L2-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "30b2bbce0ca4cb066721c94a64e2c37b7825dd72fc19c20eb0ab156bea0f8efc"
		hash = "42ed73b1d5cc49e09136ec05befabe0860002c97eb94e9bad145e4ea5b8be2e2"
		hash = "480a8c883006232361c5812af85de9799b1182f1b52145ccfced4fa21b6daafa"
		hash = "7ea7c6406c5a80d3c15511c4d97ec1e45813e9c58431f386710d0486c4898b98"
		logic_hash = "1f2406563b863b8ccd0fd8d8d33c576c4b82dabb55a1e4fa8291859323389834"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "InjectShellCode" ascii fullword
		$s1 = "DotNetLoader.exe" wide ascii fullword
		$s2 = "clipboardinject" ascii fullword
		$s3 = "download.php?raw=1" wide
		$s4 = "Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\Levint" wide
		$s5 = "FlashUpdate.exe" wide
		$s6 = "raw_cc_url" ascii fullword
		$op1 = { 48 8b 4c 24 78 48 89 01 e9 1a ff ff ff 48 8b 44 }
		$op2 = { ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and $x1 or 3 of them
}

Strings (9 patterns)

Identifier	Type	Value	Modifiers
$x1	text	"InjectShellCode"	ascii fullword
$s1	text	"DotNetLoader.exe"	wide ascii fullword
$s2	text	"clipboardinject"	ascii fullword
$s3	text	"download.php?raw=1"	wide
$s4	text	"Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\Levint"	wide
$s5	text	"FlashUpdate.exe"	wide
$s6	text	"raw_cc_url"	ascii fullword
$op1	hex	{ 48 8b 4c 24 78 48 89 01 e9 1a ff ff ff 48 8b 44 }
$op2	hex	{ ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }

Condition

uint16( 0 ) == 0x5a4d and filesize < 200KB and $x1 or 3 of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 200KB (a cheap guard that skips large files).
At least 3 patterns in the rule must match.
Pattern $x1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://twitter.com/JAMESWT_MHT/status/1316387482708119556

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

30b2bbce0ca4cb066721c94a64e2c37b7825dd72fc19c20eb0ab156bea0f8efc
42ed73b1d5cc49e09136ec05befabe0860002c97eb94e9bad145e4ea5b8be2e2
480a8c883006232361c5812af85de9799b1182f1b52145ccfced4fa21b6daafa
7ea7c6406c5a80d3c15511c4d97ec1e45813e9c58431f386710d0486c4898b98

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 47417488-e843-5346-9baa-fcce30b884d1

Tags:FILE

SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24