Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_EXT_APT32_Osx_Backdoor_Loader

Detects APT32 backdoor loader on OSX

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Facebook
Date
2021-02-25
Modified
2023-12-05
Score / Quality
75 / 85

What this rule detects

Detects APT32 backdoor loader on OSX

Targets: macOS Mach-O.

It defines 8 patterns (4 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
ext-apt32-osx-backdoor-loader.yarDetection Rule License 1.1
rule SIGNATURE_BASE_EXT_APT32_Osx_Backdoor_Loader : FILE
{
	meta:
		description = "Detects APT32 backdoor loader on OSX"
		author = "Facebook"
		id = "ac313bd8-bf15-5b72-b651-35015f71dd90"
		date = "2021-02-25"
		modified = "2023-12-05"
		reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt32.yar#L22-L49"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb"
		logic_hash = "26964f95a9298b838e06fb9d7f739c8b87a976d8da7fb08416e952d26e84b84e"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$a1 = { 00 D2 44 8A 04 0F 44 88 C0 C0 E8 07 08 D0 88 44 0F FF 48 FF C1 48 83 F9 10 44 88 C2 }
		$a2 = { 41 0F 10 04 07 0F 57 84 05 A0 FE FF FF 41 0F 11 04 07 48 83 C0 10 48 83 F8 10 75 }
		$e1 = { CA CF 3E F2 DA 43 E6 D1  D5 6C D4 23 3A AE F1 B2 }
		$e2 = "MlkHVdRbOkra9s+G65MAoLga340t3+zj/u8LPfP3hig="
		$e3 = { 5A 69 98 0E 6C 4B 5C 69  7E 19 34 3B C3 07 CA 13 }
		$e4 = "1Sib4HfPuRQjpxIpECnxxTPiu3FXOFAHMx/+9MEVv9M+h1ngV7T5WUP3b0zsg0Qd"
		$e5 = "_ArchaeologistCodeine"
		$e6 = "_PlayerAberadurtheIncomprehensible"

	condition:
		(( uint32( 0 ) == 0xfeedface or uint32be( 0 ) == 0xfeedface ) or ( uint32( 0 ) == 0xfeedfacf or uint32be( 0 ) == 0xfeedfacf ) ) and ( 2 of ( $e* ) or all of ( $a* ) )
}

Strings (8 patterns)

IdentifierTypeValueModifiers
$a1hex{ 00 D2 44 8A 04 0F 44 88 C0 C0 E8 07 08 D0 88 44 0F FF 48 FF C1 48 83 F9 10 44 88 C2 }
$a2hex{ 41 0F 10 04 07 0F 57 84 05 A0 FE FF FF 41 0F 11 04 07 48 83 C0 10 48 83 F8 10 75 }
$e1hex{ CA CF 3E F2 DA 43 E6 D1 D5 6C D4 23 3A AE F1 B2 }
$e2text"MlkHVdRbOkra9s+G65MAoLga340t3+zj/u8LPfP3hig="
$e3hex{ 5A 69 98 0E 6C 4B 5C 69 7E 19 34 3B C3 07 CA 13 }
$e4text"1Sib4HfPuRQjpxIpECnxxTPiu3FXOFAHMx/+9MEVv9M+h1ngV7T5WUP3b0zsg0Qd"
$e5text"_ArchaeologistCodeine"
$e6text"_PlayerAberadurtheIncomprehensible"

Condition

(( uint32( 0 ) == 0xfeedface or uint32be( 0 ) == 0xfeedface ) or ( uint32( 0 ) == 0xfeedfacf or uint32be( 0 ) == 0xfeedfacf ) ) and ( 2 of ( $e* ) or all of ( $a* ) )

In plain words (Heuristic)

  • The file must start with a Mach-O / fat binary magic — a macOS executable.
  • All patterns in ( $a* ) must match.
  • At least 2 patterns in ( $e* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb

Licence & attribution

Author: Facebook

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: ac313bd8-bf15-5b72-b651-35015f71dd90

Tags:FILE

Related rules