YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_APT27_Rshell_Jul24

YARA rule to detect RSHELL of APT27

APT / threat actorRSHELL / SYSUPDATESignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Bundesamt fuer Verfassungsschutz, modified by Florian Roth
Date: 2024-07-11
Modified: 2024-12-12
Score / Quality: 75 / 85

What this rule detects

YARA rule to detect RSHELL of APT27

Associated malware family: RSHELL / SYSUPDATE.

Targets: Linux ELF, macOS Mach-O.

It defines 6 patterns (4 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-mal-apt27-rshell-jul24.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_APT27_Rshell_Jul24 : MALWARE RSHELL___SYSUPDATE FILE
{
	meta:
		description = "YARA rule to detect RSHELL of APT27"
		author = "Bundesamt fuer Verfassungsschutz, modified by Florian Roth"
		id = "67c8ac4e-8e2f-5cca-90cb-5d5fdf6f86b5"
		date = "2024-07-11"
		modified = "2024-12-12"
		reference = "https://x.com/bfv_bund/status/1811364839656185985?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt27_rshell.yar#L2-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "0433edfad648e1e29be54101abaded690302dc7e49ad916cfbbddf99b3ade12c"
		hash = "10bb89fdf25c88d3c5623e8d68573124c9a42549750014e3675e2ca342aeba4a"
		hash = "2603e1f61363451891c97b0c4ce8acfbfb680d3df4282f9d151ecce3a5679616"
		hash = "70dac42491f8f19568a5d7b1d10b29f732a88d75e7f2bfa07b23202bacadf56f"
		hash = "b988a6583ce40f07e5fc8e890ae2b1c84a93db8a2e3ca8769241b94bea332a7a"
		hash = "c4fe1e56f601d411e2385352606524fb8bbf773bc2ba14889a8de605c2d14da0"
		hash = "c787144d285fcca8a542f7a5525a37bcd089b39068b9a4db7fe3554ee6c08301"
		hash = "ddaa4d23e4651a517fffbd29f0924607ba6b6253171144da5e49237afe91666b"
		logic_hash = "be5f6281d722bd07e53acd459c794fe3ae870a05ed8979de4c28d357110617bd"
		score = 75
		quality = 85
		tags = "MALWARE, RSHELL / SYSUPDATE, FILE"
		sharing = "TLP:WHITE"
		category = "MALWARE"
		malware = "RSHELL / SYSUPDATE"

	strings:
		$a1 = "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%" ascii
		$a2 = "/proc/self/exe" ascii
		$s1 = "HISTFILE" ascii fullword
		$s2 = "/tmp/guid" ascii fullword
		$sop1 = { e8 ?? ?? ?? ?? c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? }
		$sop2 = { c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? f7 d8 }

	condition:
		( uint32be( 0 ) == 0x7f454c46 or ( uint32be( 0 ) == 0xcafebabe and uint32be( 4 ) < 0x20 ) or uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xfeedfacf ) and filesize < 2MB and all of ( $a* ) and 2 of ( $s* ) or 3 of ( $s* )
}

Strings (6 patterns)

Identifier	Type	Value	Modifiers
$a1	text	"%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%"	ascii
$a2	text	"/proc/self/exe"	ascii
$s1	text	"HISTFILE"	ascii fullword
$s2	text	"/tmp/guid"	ascii fullword
$sop1	hex	{ e8 ?? ?? ?? ?? c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? }
$sop2	hex	{ c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? f7 d8 }

Condition

( uint32be( 0 ) == 0x7f454c46 or ( uint32be( 0 ) == 0xcafebabe and uint32be( 4 ) < 0x20 ) or uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xfeedfacf ) and filesize < 2MB and all of ( $a* ) and 2 of ( $s* ) or 3 of ( $s* )

In plain words (Heuristic)

The file must start with the ELF header — a Linux/Unix executable.
The file must start with a Mach-O / fat binary magic — a macOS executable.
The file must be smaller than 2MB (a cheap guard that skips large files).
All patterns in ( $a* ) must match.
At least 2 patterns in ( $s* ) must match.
At least 3 patterns in ( $s* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://x.com/bfv_bund/status/1811364839656185985?s=12&t=C0_T_re0wRP_NfKa27Xw9w

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

0433edfad648e1e29be54101abaded690302dc7e49ad916cfbbddf99b3ade12c
10bb89fdf25c88d3c5623e8d68573124c9a42549750014e3675e2ca342aeba4a
2603e1f61363451891c97b0c4ce8acfbfb680d3df4282f9d151ecce3a5679616
70dac42491f8f19568a5d7b1d10b29f732a88d75e7f2bfa07b23202bacadf56f
b988a6583ce40f07e5fc8e890ae2b1c84a93db8a2e3ca8769241b94bea332a7a
c4fe1e56f601d411e2385352606524fb8bbf773bc2ba14889a8de605c2d14da0
c787144d285fcca8a542f7a5525a37bcd089b39068b9a4db7fe3554ee6c08301
ddaa4d23e4651a517fffbd29f0924607ba6b6253171144da5e49237afe91666b

Licence & attribution

Author: Bundesamt fuer Verfassungsschutz, modified by Florian Roth

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 67c8ac4e-8e2f-5cca-90cb-5d5fdf6f86b5

Metadata

sharing	TLP:WHITE
category	MALWARE
malware	RSHELL / SYSUPDATE

Tags:MALWARE RSHELL___SYSUPDATE FILE