Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_APT_NK_Andariel_HHSD_Filetransfertool

Detects a variant of the HHSD File Transfer Tool

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
CISA.gov
Date
2024-07-25
Modified
2025-07-09
Score / Quality
70 / 85

What this rule detects

Detects a variant of the HHSD File Transfer Tool

Targets: Windows PE.

It defines 4 patterns (0 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-apt-nk-andariel-hhsd-filetransfertool.yarDetection Rule License 1.1
rule SIGNATURE_BASE_MAL_APT_NK_Andariel_HHSD_Filetransfertool : FILE
{
	meta:
		description = "Detects a variant of the HHSD File Transfer Tool"
		author = "CISA.gov"
		id = "46b6dbaf-1272-5bbd-a586-5e48ba6c5022"
		date = "2024-07-25"
		modified = "2025-07-09"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L87-L125"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "665c1b27d64d5377be98aa4e629b077e56f3a44273d98653a338439b3dc05b65"
		score = 70
		quality = 85
		tags = "FILE"

	strings:
		$handshake = { 30 ?? ?? 81 7? ?? 22 C0 78 00 4? 88 }
		$err_xor_str = { 14 C7 [2] 14 00 41 00 C7 [2] 7A 00 7F 00 C7 [2] 7B 00 63 00 C7 [2] 7A 00 34 00 }
		$hash_call_loadlib = { B? 8D 10 B7 F8 E8 }
		$hash_call_unk = { B? 91 B8 F6 88 E8 }

	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $handshake , $err_xor_str ) and 1 of ( $hash_call_* ) or 2 of ( $handshake , $err_xor_str )
}

Strings (4 patterns)

IdentifierTypeValueModifiers
$handshakehex{ 30 ?? ?? 81 7? ?? 22 C0 78 00 4? 88 }
$err_xor_strhex{ 14 C7 [2] 14 00 41 00 C7 [2] 7A 00 7F 00 C7 [2] 7B 00 63 00 C7 [2] 7A 00 34 00 }
$hash_call_loadlibhex{ B? 8D 10 B7 F8 E8 }
$hash_call_unkhex{ B? 91 B8 F6 88 E8 }

Condition

uint16( 0 ) == 0x5a4d and 1 of ( $handshake , $err_xor_str ) and 1 of ( $hash_call_* ) or 2 of ( $handshake , $err_xor_str )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 1 patterns in ( $handshake , $err_xor_str ) must match.
  • At least 1 patterns in ( $hash_call_* ) must match.
  • At least 2 patterns in ( $handshake , $err_xor_str ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: CISA.gov

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 46b6dbaf-1272-5bbd-a586-5e48ba6c5022

Tags:FILE

Related rules