YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1

Detects Hermetic Wiper malware

APT / threat actorHermeticwiperSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2022-02-24
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects Hermetic Wiper malware

Associated malware family: Hermeticwiper.

Targets: Windows PE.

It defines 8 patterns (4 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-ua-hermetic-wiper-feb22-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1 : FILE
{
	meta:
		description = "Detects Hermetic Wiper malware"
		author = "Florian Roth (Nextron Systems)"
		id = "2cbe4a69-e31a-5f5f-ab1a-9d71d16fb30f"
		date = "2022-02-24"
		modified = "2023-12-05"
		reference = "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_hermetic_wiper.yar#L2-L38"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
		hash = "3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767"
		hash = "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf"
		hash = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
		logic_hash = "1cf124f7533a060da8aff1a18f64a94b183502e58ffdfca012d72d99d30225ba"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$xc1 = { 00 5C 00 5C 00 2E 00 5C 00 50 00 68 00 79 00 73
               00 69 00 63 00 61 00 6C 00 44 00 72 00 69 00 76
               00 65 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
               00 45 00 50 00 4D 00 4E 00 54 00 44 00 52 00 56
               00 5C 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
               00 00 00 00 00 25 00 73 00 25 00 2E 00 32 00 73
               00 00 00 00 00 24 00 42 00 69 00 74 00 6D 00 61
               00 70 00 00 00 24 00 4C 00 6F 00 67 00 46 00 69
               00 6C 00 65 }
		$sc1 = { 00 44 00 72 00 69 00 76 00 65 00 72 00 73 00 00
               00 64 00 72 00 76 00 00 00 53 00 79 00 73 00 74
               00 65 00 6D 00 33 00 32 }
		$s1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
		$s2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
		$s3 = "DRV_XP_X64" wide fullword
		$s4 = "%ws%.2ws" wide fullword
		$op1 = { 8b 7e 08 0f 57 c0 8b 46 0c 83 ef 01 66 0f 13 44 24 20 83 d8 00 89 44 24 18 0f 88 3b 01 00 00 }
		$op2 = { 13 fa 8b 55 f4 4e 3b f3 7f e6 8a 45 0f 01 4d f0 0f 57 c0 }

	condition:
		( uint16( 0 ) == 0x5a53 or uint16( 0 ) == 0x5a4d ) and filesize < 400KB and ( 1 of ( $x* ) or 3 of them )
}

Strings (8 patterns)

Identifier	Type	Value	Modifiers
$xc1	hex	{ 00 5C 00 5C 00 2E 00 5C 00 50 00 68 00 79 00 73 00 69 00 63 00 61 00 6C 00 44 00 72 00 69 00 76 00 65 00 25 00 75 00 00 00 5C 00 …
$sc1	hex	{ 00 44 00 72 00 69 00 76 00 65 00 72 00 73 00 00 00 64 00 72 00 76 00 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 }
$s1	text	"\\\\?\\C:\\Windows\\System32\\winevt\\Logs"	wide fullword
$s2	text	"\\\\.\\EPMNTDRV\\%u"	wide fullword
$s3	text	"DRV_XP_X64"	wide fullword
$s4	text	"%ws%.2ws"	wide fullword
$op1	hex	{ 8b 7e 08 0f 57 c0 8b 46 0c 83 ef 01 66 0f 13 44 24 20 83 d8 00 89 44 24 18 0f 88 3b 01 00 00 }
$op2	hex	{ 13 fa 8b 55 f4 4e 3b f3 7f e6 8a 45 0f 01 4d f0 0f 57 c0 }

Condition

( uint16( 0 ) == 0x5a53 or uint16( 0 ) == 0x5a4d ) and filesize < 400KB and ( 1 of ( $x* ) or 3 of them )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 400KB (a cheap guard that skips large files).
At least 1 patterns in ( $x* ) must match.
At least 3 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da
3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767
2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf
1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 2cbe4a69-e31a-5f5f-ab1a-9d71d16fb30f

Tags:FILE

SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
MALPEDIA_Win_Hermeticwiper_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
TRELLIX_ARC_Hermeticwiper
MalwareTrellix Advanced Research Center· cb @ Trellix ATR· 2022-02-24
SEKOIA_Wiper_Hermeticwiper_Variants
MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-24
CLUSTER25_UNC1222_Hermeticwiper_23433_10001Metadata only
MalwareCluster25 (via Open-Source-YARA-rules)· Cluster25· 2022-02-23
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16

More Hermeticwiper rules