YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_EXT_APT_UNC2891_SLAPSTICK

Detects SLAPSTICK malware used by UNC2891

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Mandiant
Date: 2022-03-17
Modified: 2026-05-15
Score / Quality: 80 / 85

What this rule detects

Detects SLAPSTICK malware used by UNC2891

Targets: Linux ELF.

It defines 3 patterns (0 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

ext-apt-unc2891-slapstick.yarDetection Rule License 1.1

rule SIGNATURE_BASE_EXT_APT_UNC2891_SLAPSTICK : FILE
{
	meta:
		description = "Detects SLAPSTICK malware used by UNC2891"
		author = "Mandiant"
		id = "2e97b8cb-a86e-5be9-92dc-fd1474aa9547"
		date = "2022-03-17"
		modified = "2026-05-15"
		reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2891_tinyshell_slapstick.yar#L46-L60"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "b046a949dab2f38b8181782cc6ea0782d2e102c0c30bc782de74112a77c23d6e"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$ss1 = { 25 59 20 25 62 20 25 64 20 25 48 3a 25 4d 3a 25 53 20 20 20 20 00 }
		$ss2 = { 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 00 }
		$ss3 = { 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 73 0a 00 }

	condition:
		( uint32( 0 ) == 0x464c457f ) and all of them
}

Strings (3 patterns)

Identifier	Type	Value
$ss1	hex	{ 25 59 20 25 62 20 25 64 20 25 48 3a 25 4d 3a 25 53 20 20 20 20 00 }
$ss2	hex	{ 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 00 }
$ss3	hex	{ 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 73 0a 00 }

Condition

( uint32( 0 ) == 0x464c457f ) and all of them

In plain words (Heuristic)

The file must start with the ELF header — a Linux/Unix executable.
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.mandiant.com/resources/blog/unc2891-overview

Licence & attribution

Author: Mandiant

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 2e97b8cb-a86e-5be9-92dc-fd1474aa9547

Tags:FILE

SIGNATURE_BASE_M_APT_Downloader_BEATDROP
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2022-04-28
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
SIGNATURE_BASE_APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-03-04