YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23

Detects malicious VEILEDSIGNAL backdoor

APT / threat actorVeiledsignalSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: X__Junior
Date: 2023-04-20
Modified: 2023-12-05
Score / Quality: 85 / 85

What this rule detects

Detects malicious VEILEDSIGNAL backdoor

Associated malware family: Veiledsignal.

Targets: Windows PE.

It defines 3 patterns (0 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-mal-veiledsignal-backdoor-apr23.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 : FILE
{
	meta:
		description = "Detects malicious VEILEDSIGNAL backdoor"
		author = "X__Junior"
		id = "74c403ea-3178-58e8-88b3-a51c1d475868"
		date = "2023-04-20"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L2-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
		logic_hash = "4fe1a1b09344cd84f981b193b480d23807893b59ad781868d82089a7306c042f"
		score = 85
		quality = 85
		tags = "FILE"

	strings:
		$op1 = {B8 AB AA AA AA F7 E1 8B C1 C1 EA 02 8D 14 52 03 D2 2B C2 8A 84 05 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ??}
		$op2 = { 50 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 3C 00 00 00 C7 85 ?? ?? ?? ?? 40 00 00 00 C7 85 ?? ?? ?? ?? 05 00 00 00 FF 15}
		$op3 = { 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 }

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

Strings (3 patterns)

Identifier	Type	Value
$op1	hex	{B8 AB AA AA AA F7 E1 8B C1 C1 EA 02 8D 14 52 03 D2 2B C2 8A 84 05 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ??}
$op2	hex	{ 50 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 3C 00 00 00 C7 85 ?? ?? ?? ?? 40 00 00 00 …
$op3	hex	{ 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 }

Condition

uint16( 0 ) == 0x5a4d and all of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43

Licence & attribution

Author: X__Junior

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 74c403ea-3178-58e8-88b3-a51c1d475868

Tags:FILE

SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2
APT / threat actorSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-29
SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3
APT / threat actorSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-29
SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4
APT / threat actorSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-29
SIGNATURE_BASE_SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
Suspicious / huntingSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-20
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20

More Veiledsignal rules