YARA · Signature Base (Florian Roth / Nextron)
SIGNATURE_BASE_APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine
Detects Ruby ShellCode XOR routine used by ScarCruft APT group
APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
- Author
- S2WLAB_TALON_JACK2
- Date
- 2021-05-20
- Modified
- 2023-12-05
- Score / Quality
- 75 / 85
What this rule detects
Detects Ruby ShellCode XOR routine used by ScarCruft APT group
It defines 2 patterns (0 text, 2 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
apt-nk-scarcruft-ruby-shellcode-xor-routine.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine : APT
{
meta:
= "Detects Ruby ShellCode XOR routine used by ScarCruft APT group"
= "S2WLAB_TALON_JACK2"
= "c393f2db-8ade-5083-9cec-f62f23056f8b"
= "2021-05-20"
= "2023-12-05"
= "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
= "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_inkysquid.yar#L104-L133"
= "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
= "a97041a06729d639c22a4ee272cc96555345b692fc0da8b62e898891d02b23ea"
= 75
= 85
= "APT"
= "APT"
= "0.1"
strings:
$hex1 = {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7}
$hex2 = {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2}
condition:
1 of them
}
Strings (2 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $hex1 | hex | {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7} | |
| $hex2 | hex | {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2} |
Condition
1 of themIn plain words (Heuristic)
- At least 1 patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
Licence & attribution
Author: S2WLAB_TALON_JACK2
Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a
Licence: Detection Rule License 1.1 (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: c393f2db-8ade-5083-9cec-f62f23056f8b
Metadata
| type | APT |
|---|---|
| version | 0.1 |
Tags:APT
Related rules
- APT / threat actorSignature Base (Florian Roth / Nextron)· S2WLAB_TALON_JACK2· 2021-07-09
- APT / threat actorSignature Base (Florian Roth / Nextron)· Markus Neis, Swisscom· 2020-06-18
- APT / threat actorSignature Base (Florian Roth / Nextron)· Markus Neis,Swisscom· 2021-03-05
- APT / threat actorSignature Base (Florian Roth / Nextron)· Markus Neis,Swisscom· 2021-03-05