YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_Cisco_LINE_VIPER_Shellcode_Initial_Execution

Detects LINE VIPER Cisco ASA malware code as part of shellcode initial execution.

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: NCSC (modifier by Florian Roth)
Date: 2025-09-25
Modified: 2025-09-27
Score / Quality: 85 / 85

What this rule detects

Detects LINE VIPER Cisco ASA malware code as part of shellcode initial execution.

It defines 4 patterns (0 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

mal-cisco-line-viper-shellcode-initial-execution.yarDetection Rule License 1.1

rule SIGNATURE_BASE_MAL_Cisco_LINE_VIPER_Shellcode_Initial_Execution
{
	meta:
		description = "Detects LINE VIPER Cisco ASA malware code as part of shellcode initial execution."
		author = "NCSC (modifier by Florian Roth)"
		id = "ca88eff7-bf0d-5959-b614-1afb6d68879e"
		date = "2025-09-25"
		modified = "2025-09-27"
		reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L100-L123"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "813aa79525bb43f62d98142eced501f793764e90a86c7176a686f9017f32eb4b"
		score = 85
		quality = 85
		tags = ""

	strings:
		$xc1 = {
         48 8D B7 80 00 00 00 BA 00 20 00 00 [19] 48 C7 C6 00
         90 00 00 BA 07 00 00 00
      }
		$xe1 = { 53 49 32 33 67 41 41 41 41 4c 6f 41 49 41 41 41 [26] 6a 48 78 67 43 51 41 41 43 36 42 77 41 41 41 }
		$xe2 = { 69 4e 74 34 41 41 41 41 43 36 41 43 41 41 41 [26] 49 78 38 59 41 6b 41 41 41 75 67 63 41 41 41 }
		$xe3 = { 49 6a 62 65 41 41 41 41 41 75 67 41 67 41 41 [26] 53 4d 66 47 41 4a 41 41 41 4c 6f 48 41 41 41 41 }

	condition:
		1 of them
}

Strings (4 patterns)

Identifier	Type	Value
$xc1	hex	{ 48 8D B7 80 00 00 00 BA 00 20 00 00 [19] 48 C7 C6 00 90 00 00 BA 07 00 00 00 }
$xe1	hex	{ 53 49 32 33 67 41 41 41 41 4c 6f 41 49 41 41 41 [26] 6a 48 78 67 43 51 41 41 43 36 42 77 41 41 41 }
$xe2	hex	{ 69 4e 74 34 41 41 41 41 43 36 41 43 41 41 41 [26] 49 78 38 59 41 6b 41 41 41 75 67 63 41 41 41 }
$xe3	hex	{ 49 6a 62 65 41 41 41 41 41 75 67 41 67 41 41 [26] 53 4d 66 47 41 4a 41 41 41 4c 6f 48 41 41 41 41 }