Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_2

Detects suspicious malware using ElRawDisk

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Florian Roth (Nextron Systems)
Date
2020-01-02
Modified
2022-12-21
Score / Quality
65 / 85

What this rule detects

Detects suspicious malware using ElRawDisk

Targets: Windows PE.

It defines 9 patterns (7 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-me-rawdisk-agent-jan20-2.yarDetection Rule License 1.1
rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_2 : FILE
{
	meta:
		description = "Detects suspicious malware using ElRawDisk"
		author = "Florian Roth (Nextron Systems)"
		id = "9817fb22-7bed-5869-aa92-66c458b81c7f"
		date = "2020-01-02"
		modified = "2022-12-21"
		reference = "https://twitter.com/jfslowik/status/1212501454549741568?s=09"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dustman.yar#L26-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
		logic_hash = "73e4a88b749e3b2654e9021290932d2e556c29cfa772785b23bebad9f3a3f90a"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "\\Release\\Dustman.pdb" ascii
		$x2 = "/c agent.exe A" fullword ascii
		$s1 = "C:\\windows\\system32\\cmd.exe" fullword ascii
		$s2 = "The Magic Word!" fullword ascii
		$s3 = "Software\\Oracle\\VirtualBox" fullword wide
		$s4 = "\\assistant.sys" wide
		$s5 = "Down With Bin Salman" fullword wide
		$sc1 = { 00 5C 00 5C 00 2E 00 5C 00 25 00 73 }
		$op1 = { 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 3000KB and ( 1 of ( $x* ) or 3 of them )
}

Strings (9 patterns)

IdentifierTypeValueModifiers
$x1text"\\Release\\Dustman.pdb"ascii
$x2text"/c agent.exe A"fullword ascii
$s1text"C:\\windows\\system32\\cmd.exe"fullword ascii
$s2text"The Magic Word!"fullword ascii
$s3text"Software\\Oracle\\VirtualBox"fullword wide
$s4text"\\assistant.sys"wide
$s5text"Down With Bin Salman"fullword wide
$sc1hex{ 00 5C 00 5C 00 2E 00 5C 00 25 00 73 }
$op1hex{ 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }

Condition

uint16( 0 ) == 0x5a4d and filesize <= 3000KB and ( 1 of ( $x* ) or 3 of them )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • The file must be smaller than 3000KB (a cheap guard that skips large files).
  • At least 1 patterns in ( $x* ) must match.
  • At least 3 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 9817fb22-7bed-5869-aa92-66c458b81c7f

Tags:FILE

Related rules