Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_Sidewinder_Implant

Detects SideWinder final payload

APT / threat actorSidewinderSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
AT&T Alien Labs
Date
2020-08-25
Modified
2023-12-05
Score / Quality
75 / 85

What this rule detects

Detects SideWinder final payload

Associated malware family: Sidewinder.

Targets: Windows PE.

It defines 2 patterns (0 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
apt-mal-sidewinder-implant.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_MAL_Sidewinder_Implant : FILE
{
	meta:
		description = "Detects SideWinder final payload"
		author = "AT&T Alien Labs"
		id = "3a420c9c-7821-5405-8d4d-6931d0f311ba"
		date = "2020-08-25"
		modified = "2023-12-05"
		reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sidewinder.yar#L24-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "c568238dcf1e30d55a398579a4704ddb8196b685"
		logic_hash = "bfad86dbdc04463e7e4cc126fd05fc9107617a7ea1bd3f283c0e0170862bd59b"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$code = { 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00
               00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73
               5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
               7D 13 00 00 04 02 02 FE 06 24 00 00 06 73 5B 00
               00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 15
               00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D
               02 28 1F 00 00 06 02 7B 12 00 00 04 16 6F 0F 00
               00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 12
               00 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06
               02 28 21 00 00 06 02 7B 12 00 00 04 16 }
		$strings = { 
         2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00
         63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00
         65 00 64 00 46 00 69 00 6C 00 65 00 73
      }

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

Strings (2 patterns)

IdentifierTypeValueModifiers
$codehex{ 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00 00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73 5B 00 00 0A 14 20 88 13 00 00 15 …
$stringshex{ 2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00 63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00 65 00 64 00 46 00 69 00 6C 00 65 0 …

Condition

uint16( 0 ) == 0x5A4D and all of them

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • c568238dcf1e30d55a398579a4704ddb8196b685

Licence & attribution

Author: AT&T Alien Labs

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 3a420c9c-7821-5405-8d4d-6931d0f311ba

Tags:FILE

Related rules

More Sidewinder rules