YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_Py

Strings from Python keylogger

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Fox-IT SRT
Date: 2019-12-20
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Strings from Python keylogger

It defines 5 patterns (5 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-mal-cn-wocao-keylogger-py.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_Py
{
	meta:
		description = "Strings from Python keylogger"
		author = "Fox-IT SRT"
		id = "f7b5ec1b-669e-5e7d-a9d3-011d212eb363"
		date = "2019-12-20"
		modified = "2023-12-05"
		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L91-L107"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "2dc2ce153d559d795f302f5ca4a9ef9e6e5c54762472e38e6f4a26ef8a28a184"
		score = 75
		quality = 85
		tags = ""

	strings:
		$a = "c:\\windows\\temp\\tap.tmp"
		$b = "c:\\windows\\temp\\mrteeh.tmp"
		$c = "GenFileName"
		$d = "outfile"
		$e = "[PASTE:%d]"

	condition:
		3 of them
}

Strings (5 patterns)

Identifier	Type	Value
$a	text	"c:\\windows\\temp\\tap.tmp"
$b	text	"c:\\windows\\temp\\mrteeh.tmp"
$c	text	"GenFileName"
$d	text	"outfile"
$e	text	"[PASTE:%d]"

Condition

3 of them

In plain words (Heuristic)

At least 3 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/

Licence & attribution

Author: Fox-IT SRT

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: f7b5ec1b-669e-5e7d-a9d3-011d212eb363

SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Csharp
APT / threat actorSignature Base (Florian Roth / Nextron)· Fox-IT SRT· 2019-12-20
SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_B64Encoded
APT / threat actorSignature Base (Florian Roth / Nextron)· Fox-IT SRT· 2019-12-20
SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_Dropper
APT / threat actorSignature Base (Florian Roth / Nextron)· Fox-IT SRT· 2019-12-20
SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py
APT / threat actorSignature Base (Florian Roth / Nextron)· Fox-IT SRT· 2019-12-20
SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py_B64Encoded
APT / threat actorSignature Base (Florian Roth / Nextron)· Fox-IT SRT· 2019-12-20
SIGNATURE_BASE_APT_MAL_CN_Wocao_Checkadmin_Bin
APT / threat actorSignature Base (Florian Roth / Nextron)· Fox-IT SRT· 2019-12-20
SIGNATURE_BASE_APT_MAL_CN_Wocao_Getos_Py
APT / threat actorSignature Base (Florian Roth / Nextron)· Fox-IT SRT· 2019-12-20
SIGNATURE_BASE_APT_MAL_CN_Wocao_Info_Vbs
APT / threat actorSignature Base (Florian Roth / Nextron)· Fox-IT SRT· 2019-12-20