YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_Nazar_Svchost_Commands

Detects Nazar's svchost based on supported commands

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Itay Cohen
Date: 2020-04-26
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects Nazar's svchost based on supported commands

It defines 5 patterns (0 text, 5 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-nazar-svchost-commands.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_Nazar_Svchost_Commands
{
	meta:
		description = "Detects Nazar's svchost based on supported commands"
		author = "Itay Cohen"
		id = "3e02381d-de03-50c8-8bde-2974ee96b7c1"
		date = "2020-04-26"
		modified = "2023-12-05"
		reference = "https://www.epicturla.com/blog/the-lost-nazar"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nazar.yar#L1-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
		hash = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
		logic_hash = "c71e8a3b2d69c51ed3f822f62b90906fc0a21d32f1f1850cdef71c335964f9b1"
		score = 75
		quality = 85
		tags = ""

	strings:
		$str1 = { 33 31 34 00 36 36 36 00 33 31 33 00 }
		$str2 = { 33 31 32 00 33 31 35 00 35 35 35 00 }
		$str3 = { 39 39 39 00 35 39 39 00 34 39 39 00 }
		$str4 = { 32 30 39 00 32 30 31 00 32 30 30 00 }
		$str5 = { 31 39 39 00 31 31 39 00 31 38 39 00 31 33 39 00 33 31 31 00 }

	condition:
		4 of them
}

Strings (5 patterns)

Identifier	Type	Value
$str1	hex	{ 33 31 34 00 36 36 36 00 33 31 33 00 }
$str2	hex	{ 33 31 32 00 33 31 35 00 35 35 35 00 }
$str3	hex	{ 39 39 39 00 35 39 39 00 34 39 39 00 }
$str4	hex	{ 32 30 39 00 32 30 31 00 32 30 30 00 }
$str5	hex	{ 31 39 39 00 31 31 39 00 31 38 39 00 31 33 39 00 33 31 31 00 }

Condition

4 of them

In plain words (Heuristic)

At least 4 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.epicturla.com/blog/the-lost-nazar

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6
be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728

Licence & attribution

Author: Itay Cohen

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 3e02381d-de03-50c8-8bde-2974ee96b7c1