Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop

Detects RC4 loop in Lazarus Group implant

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
f-secure
Date
2020-06-10
Modified
2023-12-05
Score / Quality
75 / 85

What this rule detects

Detects RC4 loop in Lazarus Group implant

It defines 1 patterns (0 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
apt-nk-lazarus-rc4-loop.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop : FILE
{
	meta:
		description = "Detects RC4 loop in Lazarus Group implant"
		author = "f-secure "
		id = "a9503795-b4b8-505e-a1bf-df64ec8c1c32"
		date = "2020-06-10"
		modified = "2023-12-05"
		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_aug20.yar#L2-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "b0e96bfff924a0c9b39e1ab03097ae0790743417d9da70917d64bc238905971e"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$str_rc4_loop = { 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48 
                        FF C? 43 0F B6 0? ?? 41 00 8? 01 01 00 00 41 0F 
                        B6 ?? 01 01 00 00 }

	condition:
		int16 ( 0 ) == 0x5a4d and filesize < 3000KB and $str_rc4_loop
}

Strings (1 patterns)

IdentifierTypeValueModifiers
$str_rc4_loophex{ 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48 FF C? 43 0F B6 0? ?? 41 00 8? 01 01 00 00 41 0F B6 ?? 01 01 …

Condition

int16 ( 0 ) == 0x5a4d and filesize < 3000KB and $str_rc4_loop

In plain words (Heuristic)

  • The file must be smaller than 3000KB (a cheap guard that skips large files).
  • Pattern $str_rc4_loop must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: f-secure

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: a9503795-b4b8-505e-a1bf-df64ec8c1c32

Tags:FILE

Related rules