YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_NK_MAL_DLL_Apr23_1

Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2023-04-03
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)

Targets: Windows PE.

It defines 7 patterns (4 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-nk-mal-dll-apr23-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_NK_MAL_DLL_Apr23_1 : FILE
{
	meta:
		description = "Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)"
		author = "Florian Roth (Nextron Systems)"
		id = "c2abe266-0c21-51aa-9426-46a4f59df937"
		date = "2023-04-03"
		modified = "2023-12-05"
		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mal_gopuram_apr23.yar#L43-L75"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf"
		hash = "bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9"
		hash = "dca33d6dacac0859ec2f3104485720fe2451e21eb06e676f4860ecc73a41e6f9"
		hash = "fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e"
		logic_hash = "e0a8f3896c0119ce399e83fe3e565c66144693e84996aa3d01ca1b6315521782"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "vG2eZ1KOeGd2n5fr" ascii fullword
		$s1 = "Windows %d(%d)-%s" ascii fullword
		$s2 = "auth_timestamp: " ascii fullword
		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" wide fullword
		$op1 = { b8 c8 00 00 00 83 fb 01 44 0f 47 e8 41 8b c5 48 8b b4 24 e0 18 00 00 4c 8b a4 24 e8 18 00 00 48 8b 8d a0 17 00 00 48 33 cc }
		$op2 = { 33 d2 46 8d 04 b5 00 00 00 00 66 0f 1f 44 00 00 49 63 c0 41 ff c0 8b 4c 84 70 31 4c 94 40 48 ff c2 }
		$op3 = { 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 2 of them ) or ( $x1 and 1 of ( $s* ) or 3 of them )
}

Strings (7 patterns)

Identifier	Type	Value	Modifiers
$x1	text	"vG2eZ1KOeGd2n5fr"	ascii fullword
$s1	text	"Windows %d(%d)-%s"	ascii fullword
$s2	text	"auth_timestamp: "	ascii fullword
$s3	text	"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36"	wide fullword
$op1	hex	{ b8 c8 00 00 00 83 fb 01 44 0f 47 e8 41 8b c5 48 8b b4 24 e0 18 00 00 4c 8b a4 24 e8 18 00 00 48 8b 8d a0 17 00 00 48 33 cc }
$op2	hex	{ 33 d2 46 8d 04 b5 00 00 00 00 66 0f 1f 44 00 00 49 63 c0 41 ff c0 8b 4c 84 70 31 4c 94 40 48 ff c2 }
$op3	hex	{ 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }

Condition

uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 2 of them ) or ( $x1 and 1 of ( $s* ) or 3 of them )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 500KB (a cheap guard that skips large files).
At least 1 patterns in ( $x* ) must match.
At least 2 patterns in the rule must match.
At least 1 patterns in ( $s* ) must match.
At least 3 patterns in the rule must match.
Pattern $x1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf
bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9
dca33d6dacac0859ec2f3104485720fe2451e21eb06e676f4860ecc73a41e6f9
fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: c2abe266-0c21-51aa-9426-46a4f59df937

Tags:FILE

SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24