YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1

Detect the Nighthawk dropped beacon

Hack toolNighthawkSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Arkbird_SOLG
Date: 2022-11-22
Modified: 2025-07-01
Score / Quality: 75 / 85

What this rule detects

Detect the Nighthawk dropped beacon

Associated malware family: Nighthawk.

Targets: Windows PE.

It defines 4 patterns (0 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

hktl-mal-nighthawk-nov-2022-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1 : NIGHTHAWK BEACON FILE
{
	meta:
		description = "Detect the Nighthawk dropped beacon"
		author = "Arkbird_SOLG"
		id = "a46d5034-e8e3-5c30-90d9-ea97b8384341"
		date = "2022-11-22"
		modified = "2025-07-01"
		reference = "https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_nighthawk_c2.yar#L32-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
		hash = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
		hash = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
		logic_hash = "8dec7752ee6e1af87129ce7ac09130f94a20807c4f45ceb1fce434358ac727bf"
		score = 75
		quality = 85
		tags = "NIGHTHAWK, BEACON, FILE"

	strings:
		$s1 = { 44 8b ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d c0 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 20 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 00 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d e0 e8 [2] ff ff 33 d2 e9 ee 04 00 00 48 8d 44 24 68 48 89 44 24 20 41 b9 01 00 00 00 45 33 c0 48 8d 95 a0 00 00 00 ff 15 [2] 09 00 85 c0 0f 85 74 04 00 00 48 89 7c 24 28 48 89 7c 24 20 45 33 c9 45 33 c0 48 8d 15 [2] 0a 00 48 8b 4c 24 68 ff 15 [2] 09 00 85 }
		$s2 = { 4d 85 c0 0f 84 83 00 00 00 49 21 18 33 d2 44 8d 43 01 33 c9 ff 15 [2] 08 00 48 8b f0 48 85 c0 74 6a 44 8d 43 04 48 8b d5 48 8b c8 ff 15 [2] 08 00 48 8b e8 48 85 c0 74 49 48 8d 44 24 70 33 d2 44 8d 4b 24 48 89 44 24 20 4c 8d 44 24 30 48 8b cd ff 15 [2] 08 00 8b }
		$s3 = { 48 85 c0 0f 84 [2] 00 00 4d 8b cc 49 83 7c 24 18 08 72 04 4d 8b 0c 24 4d 8b c5 49 83 7d 18 08 72 04 4d 8b 45 00 49 8b ?? 49 83 ?? 18 08 72 03 49 8b }
		$s4 = { 44 8b 44 24 44 4c 89 [2-3] 89 95 00 02 00 00 2b c7 8b d7 49 03 d0 48 03 d1 4c 8d 8d 00 02 00 00 44 8b c0 49 8b cf ff 15 [2] 04 00 33 d2 85 c0 0f 84 [2] ff ff 03 bd 00 02 00 00 8b 44 24 40 3b f8 48 8b 4d ?? 4c 8b }

	condition:
		uint16( 0 ) == 0x5A4D and filesize > 60KB and all of ( $s* )
}

Strings (4 patterns)

Identifier	Type	Value
$s1	hex	{ 44 8b ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d c0 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 20 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 00 e8 …
$s2	hex	{ 4d 85 c0 0f 84 83 00 00 00 49 21 18 33 d2 44 8d 43 01 33 c9 ff 15 [2] 08 00 48 8b f0 48 85 c0 74 6a 44 8d 43 04 48 8b d5 48 8b c8 ff 15 [2] 08 00 48 8b e8 48 …
$s3	hex	{ 48 85 c0 0f 84 [2] 00 00 4d 8b cc 49 83 7c 24 18 08 72 04 4d 8b 0c 24 4d 8b c5 49 83 7d 18 08 72 04 4d 8b 45 00 49 8b ?? 49 83 ?? 18 08 72 03 49 8b }
$s4	hex	{ 44 8b 44 24 44 4c 89 [2-3] 89 95 00 02 00 00 2b c7 8b d7 49 03 d0 48 03 d1 4c 8d 8d 00 02 00 00 44 8b c0 49 8b cf ff 15 [2] 04 00 33 d2 85 c0 0f 84 [2] ff ff …

Condition

uint16( 0 ) == 0x5A4D and filesize > 60KB and all of ( $s* )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be larger than 60KB.
All patterns in ( $s* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988
9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8
f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e

Licence & attribution

Author: Arkbird_SOLG

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: a46d5034-e8e3-5c30-90d9-ea97b8384341

Tags:NIGHTHAWK BEACON FILE

SIGNATURE_BASE_EXT_HKTL_Nighthawk_RAT
Hack toolSignature Base (Florian Roth / Nextron)· Frank Boldewin (@r3c0nst)· 2022-11-22
MALPEDIA_Win_Nighthawk_Auto
Hack toolMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
CAPE_Nighthawk
Hack toolCAPE Sandbox (CAPEv2)· Nikhil Ashok Hegde <@ka1do9>· 2022-12-03
R3C0NST_Nighthawk_RATMetadata only
Hack toolFrank Boldewin (R3c0nst)· Frank Boldewin (@r3c0nst)· 2022-11-30
SEKOIA_Rat_Win_Nighthawk
MalwareSEKOIA.IO Community· Sekoia.io· 2022-11-23
SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2020-08-24
SIGNATURE_BASE_MAL_Ransom_Ragnarlocker_July_2020_1
MalwareSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2020-07-30
SIGNATURE_BASE_EXPL_CVE_2021_1647_Apr21_1
ExploitSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2021-05-04

More Nighthawk rules