Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1

Detects variants of GoldenSpy Malware

APT / threat actorGoldenspySignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
BKA
Date
2020-08-21
Modified
2023-12-05
Score / Quality
75 / 85

What this rule detects

Detects variants of GoldenSpy Malware

Associated malware family: Goldenspy.

Targets: Windows PE.

It defines 8 patterns (7 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
apt-mal-bka-goldenspy-aug20-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1 : FILE
{
	meta:
		description = "Detects variants of GoldenSpy Malware"
		author = "BKA"
		id = "4f47087e-6e68-53ff-9446-72a1751da359"
		date = "2020-08-21"
		modified = "2023-12-05"
		reference = "https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_goldenspy.yar#L1-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "ba81a2b081842aaf06bbf623640a87946894df83fd0d7b7149c48afa8ed0a081"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$str01 = {c78510ffffff00000000 c78514ffffff0f000000 c68500ffffff00 c78528ffffff00000000 c7852cffffff0f000000 c68518ffffff00 c78540ffffff00000000 c78544ffffff0f000000 c68530ffffff00 c645fc14 80bd04feffff00}
		$str02 = "Ryeol HTTP Client Class" ascii
		$str03 = "----RYEOL-FB3B405B7EAE495aB0C0295C54D4E096-" ascii
		$str04 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\fwkp.exe" ascii
		$str05 = "svmm" ascii
		$str06 = "PROTOCOL_" ascii
		$str07 = "softList" ascii
		$str08 = "excuteExe" ascii

	condition:
		uint16( 0 ) == 0x5A4D and 5 of ( $str* )
}

Strings (8 patterns)

IdentifierTypeValueModifiers
$str01hex{c78510ffffff00000000 c78514ffffff0f000000 c68500ffffff00 c78528ffffff00000000 c7852cffffff0f000000 c68518ffffff00 c78540ffffff00000000 c78544ffffff0f000000 c68 …
$str02text"Ryeol HTTP Client Class"ascii
$str03text"----RYEOL-FB3B405B7EAE495aB0C0295C54D4E096-"ascii
$str04text"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\fwkp.exe"ascii
$str05text"svmm"ascii
$str06text"PROTOCOL_"ascii
$str07text"softList"ascii
$str08text"excuteExe"ascii

Condition

uint16( 0 ) == 0x5A4D and 5 of ( $str* )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 5 patterns in ( $str* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: BKA

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 4f47087e-6e68-53ff-9446-72a1751da359

Tags:FILE

Related rules