YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1

Detects Turla Kazuar malware

APT / threat actorKazuarSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2020-05-28
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects Turla Kazuar malware

Associated malware family: Kazuar.

Targets: Windows PE.

It defines 3 patterns (2 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-mal-ru-turla-kazuar-may20-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1 : FILE
{
	meta:
		description = "Detects Turla Kazuar malware"
		author = "Florian Roth (Nextron Systems)"
		id = "cd0d1fa2-5303-55f8-90a7-4a699ec79230"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://www.epicturla.com/blog/sysinturla"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_kazuar.yar#L61-L81"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
		hash = "1fca5f41211c800830c5f5c3e355d31a05e4c702401a61f11e25387e25eeb7fa"
		hash = "2d8151dabf891cf743e67c6f9765ee79884d024b10d265119873b0967a09b20f"
		hash = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
		logic_hash = "547ed3cd88057ab91a0804ecf515eacca04fcf6e490aed1ee0f6a26c3d6b8268"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "Sysinternals" ascii fullword
		$s2 = "Test Copyright" wide fullword
		$op1 = { 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

Strings (3 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"Sysinternals"	ascii fullword
$s2	text	"Test Copyright"	wide fullword
$op1	hex	{ 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }

Condition

uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 2000KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.epicturla.com/blog/sysinturla

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c
1fca5f41211c800830c5f5c3e355d31a05e4c702401a61f11e25387e25eeb7fa
2d8151dabf891cf743e67c6f9765ee79884d024b10d265119873b0967a09b20f
44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: cd0d1fa2-5303-55f8-90a7-4a699ec79230

Tags:FILE

SIGNATURE_BASE_Apt_RU_Turla_Kazuar_Debugview_Pefeatures
APT / threat actorSignature Base (Florian Roth / Nextron)· JAG-S· 2020-05-28
SEKOIA_Apt_Turla_Kazuar_Variant_2023
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-03
MALPEDIA_Win_Kazuar_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25

More Kazuar rules