YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1

Detects scheduled task pattern found in Hermetic Wiper malware related intrusions

APT / threat actorHermeticwiperSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2022-02-25
Modified: 2023-12-05
Score / Quality: 85 / 85

What this rule detects

Detects scheduled task pattern found in Hermetic Wiper malware related intrusions

Associated malware family: Hermeticwiper.

It defines 4 patterns (4 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-ua-hermetic-wiper-scheduled-task-feb22-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
{
	meta:
		description = "Detects scheduled task pattern found in Hermetic Wiper malware related intrusions"
		author = "Florian Roth (Nextron Systems)"
		id = "a628f773-9c71-5979-a4db-37b6b6bd6a56"
		date = "2022-02-25"
		modified = "2023-12-05"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_hermetic_wiper.yar#L72-L88"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "56368ba1c97fe3455312b6ee86dcd1a21677f7dfa3836e76ada4b236a5b2c171"
		score = 85
		quality = 85
		tags = ""

	strings:
		$a0 = "<Task version=" ascii wide
		$sa1 = "CSIDL_SYSTEM_DRIVE\\temp" ascii wide
		$sa2 = "postgresql.exe 1> \\\\127.0.0.1\\ADMIN$" ascii wide
		$sa3 = "cmd.exe /Q /c move CSIDL_SYSTEM_DRIVE" ascii wide

	condition:
		$a0 and 1 of ( $s* )
}

Strings (4 patterns)

Identifier	Type	Value	Modifiers
$a0	text	"<Task version="	ascii wide
$sa1	text	"CSIDL_SYSTEM_DRIVE\\temp"	ascii wide
$sa2	text	"postgresql.exe 1> \\\\127.0.0.1\\ADMIN$"	ascii wide
$sa3	text	"cmd.exe /Q /c move CSIDL_SYSTEM_DRIVE"	ascii wide

Condition

$a0 and 1 of ( $s* )

In plain words (Heuristic)

At least 1 patterns in ( $s* ) must match.
Pattern $a0 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: a628f773-9c71-5979-a4db-37b6b6bd6a56

SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24
MALPEDIA_Win_Hermeticwiper_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
TRELLIX_ARC_Hermeticwiper
MalwareTrellix Advanced Research Center· cb @ Trellix ATR· 2022-02-24
SEKOIA_Wiper_Hermeticwiper_Variants
MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-24
CLUSTER25_UNC1222_Hermeticwiper_23433_10001Metadata only
MalwareCluster25 (via Open-Source-YARA-rules)· Cluster25· 2022-02-23
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16

More Hermeticwiper rules