YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_APT_Nimbus_Manticore_Stager_May26

Detects .NET based stager using AppDomain Hijacking observed to be used by Nimbus Manticore (UNC1549). The stager drops another payload and establishes persistence via scheduled task.

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Jonathan Peters (Nextron Systems)
Date: 2026-05-20
Modified: 2026-06-01
Score / Quality: 80 / 85

What this rule detects

Detects .NET based stager using AppDomain Hijacking observed to be used by Nimbus Manticore (UNC1549). The stager drops another payload and establishes persistence via scheduled task.

Targets: Windows PE.

It defines 10 patterns (10 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

mal-apt-nimbus-manticore-stager-may26.yarDetection Rule License 1.1

rule SIGNATURE_BASE_MAL_APT_Nimbus_Manticore_Stager_May26 : FILE
{
	meta:
		description = "Detects .NET based stager using AppDomain Hijacking observed to be used by Nimbus Manticore (UNC1549). The stager drops another payload and establishes persistence via scheduled task."
		author = "Jonathan Peters (Nextron Systems)"
		id = "5b5e9131-f265-5a91-8390-f1110de75a39"
		date = "2026-05-20"
		modified = "2026-06-01"
		reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt35_malware_may26.yar#L18-L47"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71"
		logic_hash = "b6ea20370c929a61e628f078ed74c45bd3c7278d3e9c499dbcb9af3f33f23c78"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "MyCompany-Product-TOTP-Salt-2024!@#$" wide fullword
		$x2 = "TOTPGuardRunner" ascii fullword
		$x3 = "\\AppDomainInjection-metlifeScenario\\TOTP" ascii
		$sa1 = "EncData" ascii fullword
		$sa2 = "DecryptAndSaveToDesktop" ascii fullword
		$sa3 = "CopyHelloToDesktop" ascii fullword
		$sb1 = "doit" wide fullword
		$sb2 = "DailyTrigger" wide fullword
		$sb3 = "GetTypeFromCLSID" ascii
		$sb4 = "yyyy-MM-ddTHH:mm:ss" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $sa* ) or all of ( $sb* ) )
}

Strings (10 patterns)

Identifier	Type	Value	Modifiers
$x1	text	"MyCompany-Product-TOTP-Salt-2024!@#$"	wide fullword
$x2	text	"TOTPGuardRunner"	ascii fullword
$x3	text	"\\AppDomainInjection-metlifeScenario\\TOTP"	ascii
$sa1	text	"EncData"	ascii fullword
$sa2	text	"DecryptAndSaveToDesktop"	ascii fullword
$sa3	text	"CopyHelloToDesktop"	ascii fullword
$sb1	text	"doit"	wide fullword
$sb2	text	"DailyTrigger"	wide fullword
$sb3	text	"GetTypeFromCLSID"	ascii
$sb4	text	"yyyy-MM-ddTHH:mm:ss"	wide fullword

Condition

uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $sa* ) or all of ( $sb* ) )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
All patterns in ( $sa* ) must match.
All patterns in ( $sb* ) must match.
At least 1 patterns in ( $x* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71

Licence & attribution

Author: Jonathan Peters (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 5b5e9131-f265-5a91-8390-f1110de75a39

Tags:FILE

SIGNATURE_BASE_MAL_APT_Nimbus_Manticore_Agent_May26
MalwareSignature Base (Florian Roth / Nextron)· Jonathan Peters (Nextron Systems)· 2026-05-28
SIGNATURE_BASE_SUSP_Scheduledtasks_Nimbus_Manticore_Persistence_May26
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Jonathan Peters (Nextron Systems)· 2026-05-27
SIGNATURE_BASE_SUSP_Appdomaininjection_Keyword_May26
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Jonathan Peters (Nextron Systems)· 2026-05-27
SIGNATURE_BASE_SUSP_Nimbus_Manticore_PDF_Indicators_May26
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Jonathan Peters (Nextron Systems)· 2026-05-25
SIGNATURE_BASE_SUSP_PE_Contains_Encrypted_Executable_May26
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Jonathan Peters (Nextron Systems)· 2026-05-20