YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_Devilstongue_Hijackdll

Detects SOURGUM's DevilsTongue hijack DLL

MalwareDevilstongueSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X (with warnings)

Author: Microsoft Threat Intelligence Center (MSTIC)
Date: 2021-07-15
Modified: 2023-12-05
Score / Quality: 80 / 85

What this rule detects

Detects SOURGUM's DevilsTongue hijack DLL

Associated malware family: Devilstongue.

Targets: Windows PE.

It defines 9 patterns (7 text, 2 hex, 0 regex). YARA modules used: pe.

YARA-X says: warning[non_bool_expr]: non-boolean expression used as boolean

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

mal-devilstongue-hijackdll.yarDetection Rule License 1.1

import "pe"

rule SIGNATURE_BASE_MAL_Devilstongue_Hijackdll : FILE
{
	meta:
		description = "Detects SOURGUM's DevilsTongue hijack DLL"
		author = "Microsoft Threat Intelligence Center (MSTIC)"
		id = "390b8b73-6740-513d-8c70-c9002be0ce69"
		date = "2021-07-15"
		modified = "2023-12-05"
		reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_candiru.yar#L3-L47"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "4ad58a77f9ab5fa078dc40f3ec1d0b0180f25ff3ea304a3c85889df29739e0f5"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$str1 = "windows.old\\windows" wide
		$str2 = "NtQueryInformationThread"
		$str3 = "dbgHelp.dll" wide
		$str4 = "StackWalk64"
		$str5 = "ConvertSidToStringSidW"
		$str6 = "S-1-5-18" wide
		$str7 = "SMNew.dll"
		$code1 = { B8 FF 15 00 00 66 39 41 FA 74 06 80 79 FB E8 }
		$code2 = { 44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19 }

	condition:
		filesize < 800KB and uint16( 0 ) == 0x5A4D and ( pe.characteristics & pe.DLL ) and ( 4 of them or ( $code1 and $code2 ) or pe.imphash ( ) == "9a964e810949704ff7b4a393d9adda60" )
}

Strings (9 patterns)

Identifier	Type	Value	Modifiers
$str1	text	"windows.old\\windows"	wide
$str2	text	"NtQueryInformationThread"
$str3	text	"dbgHelp.dll"	wide
$str4	text	"StackWalk64"
$str5	text	"ConvertSidToStringSidW"
$str6	text	"S-1-5-18"	wide
$str7	text	"SMNew.dll"
$code1	hex	{ B8 FF 15 00 00 66 39 41 FA 74 06 80 79 FB E8 }
$code2	hex	{ 44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19 }

Condition

filesize < 800KB and uint16( 0 ) == 0x5A4D and ( pe.characteristics & pe.DLL ) and ( 4 of them or ( $code1 and $code2 ) or pe.imphash ( ) == "9a964e810949704ff7b4a393d9adda60" )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 800KB (a cheap guard that skips large files).
At least 4 patterns in the rule must match.
Uses the pe module.
Pattern $code1 must be present.
Pattern $code2 must be present.
Checks the PE import hash (imphash).
Requires a DLL.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/

Licence & attribution

Author: Microsoft Threat Intelligence Center (MSTIC)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 390b8b73-6740-513d-8c70-c9002be0ce69

Tags:FILE

MICROSOFT_Devilstongue_HijackdllMetadata only
MalwareMicrosoft (via Open-Source-YARA-rules)· Microsoft Threat Intelligence Center (MSTIC)· 2021-07-15
MALPEDIA_Win_Devilstongue_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04

More Devilstongue rules