YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_NK_Lazarus_Network_Backdoor_Unpacked

Detects unpacked variant of Lazarus Group network backdoor

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: f-secure
Date: 2020-06-10
Modified: 2023-12-05
Score / Quality: 75 / 75

What this rule detects

Detects unpacked variant of Lazarus Group network backdoor

It defines 10 patterns (10 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-nk-lazarus-network-backdoor-unpacked.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_NK_Lazarus_Network_Backdoor_Unpacked : FILE
{
	meta:
		description = "Detects unpacked variant of Lazarus Group network backdoor"
		author = "f-secure"
		id = "8eda9e74-1a19-5510-82d8-cd2eb324629c"
		date = "2020-06-10"
		modified = "2023-12-05"
		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_aug20.yar#L17-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "bfc3cf400eeea332e2e44b65f9728e94af0adde76b32ed4be527b25484f80745"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$str_netsh_1 = "netsh firewall add portopening TCP %d" ascii wide nocase
		$str_netsh_2 = "netsh firewall delete portopening TCP %d" ascii wide nocase
		$str_mask_1 = "cmd.exe /c \"%s >> %s 2>&1\"" ascii wide
		$str_mask_2 = "cmd.exe /c \"%s 2>> %s\"" ascii wide
		$str_mask_3 = "%s\\%s\\%s" ascii wide
		$str_other_1 = "perflog.dat" ascii wide nocase
		$str_other_2 = "perflog.evt" ascii wide nocase
		$str_other_3 = "cbstc.log" ascii wide nocase
		$str_other_4 = "LdrGetProcedureAddress" ascii
		$str_other_5 = "NtProtectVirtualMemory" ascii

	condition:
		int16 ( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $str_netsh* ) and 1 of ( $str_mask* ) and 1 of ( $str_other* )
}

Strings (10 patterns)

Identifier	Type	Value	Modifiers
$str_netsh_1	text	"netsh firewall add portopening TCP %d"	ascii wide nocase
$str_netsh_2	text	"netsh firewall delete portopening TCP %d"	ascii wide nocase
$str_mask_1	text	"cmd.exe /c \"%s >> %s 2>&1\""	ascii wide
$str_mask_2	text	"cmd.exe /c \"%s 2>> %s\""	ascii wide
$str_mask_3	text	"%s\\%s\\%s"	ascii wide
$str_other_1	text	"perflog.dat"	ascii wide nocase
$str_other_2	text	"perflog.evt"	ascii wide nocase
$str_other_3	text	"cbstc.log"	ascii wide nocase
$str_other_4	text	"LdrGetProcedureAddress"	ascii
$str_other_5	text	"NtProtectVirtualMemory"	ascii

Condition

int16 ( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $str_netsh* ) and 1 of ( $str_mask* ) and 1 of ( $str_other* )

In plain words (Heuristic)

The file must be smaller than 3000KB (a cheap guard that skips large files).
At least 1 patterns in ( $str_netsh* ) must match.
At least 1 patterns in ( $str_mask* ) must match.
At least 1 patterns in ( $str_other* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical

Licence & attribution

Author: f-secure

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 8eda9e74-1a19-5510-82d8-cd2eb324629c

Tags:FILE

SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop
APT / threat actorSignature Base (Florian Roth / Nextron)· f-secure· 2020-06-10