Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_Chrysalis_Backdoor_Feb26

Detects Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom

MalwareChrysalisSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
X__Junior
Date
2026-02-02
Modified
2026-05-15
Score / Quality
80 / 85

What this rule detects

Detects Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom

Associated malware family: Chrysalis.

It defines 3 patterns (0 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-chrysalis-backdoor-feb26.yarDetection Rule License 1.1
rule SIGNATURE_BASE_MAL_Chrysalis_Backdoor_Feb26
{
	meta:
		description = "Detects Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
		author = "X__Junior"
		id = "c3621431-9e20-5497-ad0a-e371063e7656"
		date = "2026-02-02"
		modified = "2026-05-15"
		reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/lotusblossom_notepad_exploitation.yar#L33-L51"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "e2e3d78437cf9d48c2b2264e44bb36bc2235834fc45bbb50b5d6867f336711e3"
		logic_hash = "9df8794d9927b92f0810321901aa7836f6a404d48c121818f24473e92875ecc4"
		score = 80
		quality = 85
		tags = ""

	strings:
		$opa1 = { 8B 4D ?? C1 CF ?? C1 C1 ?? 03 F9 D1 C3 8B 4D ?? C1 C1 ?? 03 F9 03 FB 8B 5D ?? 69 CF ?? ?? ?? ?? BF ?? ?? ?? ?? 2B F9 EB }
		$opa2 = { F7 E9 [0-1] 8B C2 C1 E8 ?? 03 C2 8D 0C 40 8A C3 34 ?? [0-2] 0F B6 [1-4] 0F B6 C3 8B 5D [1-3] 0F 45 D0 }
		$opb1 = { 0F B6 84 35 ?? ?? ?? ?? 88 84 3D ?? ?? ?? ?? 88 8C 35 ?? ?? ?? ?? 0F B6 84 3D ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 03 C2 0F B6 C0 0F B6 84 05 ?? ?? ?? ?? 30 04 19 43 3B 9D ?? ?? ?? ?? 7C }

	condition:
		(1 of ( $opa* ) and $opb1 ) or all of ( $opa* )
}

Strings (3 patterns)

IdentifierTypeValueModifiers
$opa1hex{ 8B 4D ?? C1 CF ?? C1 C1 ?? 03 F9 D1 C3 8B 4D ?? C1 C1 ?? 03 F9 03 FB 8B 5D ?? 69 CF ?? ?? ?? ?? BF ?? ?? ?? ?? 2B F9 EB }
$opa2hex{ F7 E9 [0-1] 8B C2 C1 E8 ?? 03 C2 8D 0C 40 8A C3 34 ?? [0-2] 0F B6 [1-4] 0F B6 C3 8B 5D [1-3] 0F 45 D0 }
$opb1hex{ 0F B6 84 35 ?? ?? ?? ?? 88 84 3D ?? ?? ?? ?? 88 8C 35 ?? ?? ?? ?? 0F B6 84 3D ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 03 C2 0F B6 C0 0F B6 84 05 ?? ?? ?? ?? 30 04 19 43 …

Condition

(1 of ( $opa* ) and $opb1 ) or all of ( $opa* )

In plain words (Heuristic)

  • All patterns in ( $opa* ) must match.
  • At least 1 patterns in ( $opa* ) must match.
  • Pattern $opb1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • e2e3d78437cf9d48c2b2264e44bb36bc2235834fc45bbb50b5d6867f336711e3

Licence & attribution

Author: X__Junior

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: c3621431-9e20-5497-ad0a-e371063e7656

Related rules

More Chrysalis rules