Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21

Yara Rule for WSH rat .NET packer of February 2021

MalwareWSHRATSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Yoroi Malware ZLab
Date
2021-03-09
Modified
2023-12-05
Score / Quality
75 / 85

What this rule detects

Yara Rule for WSH rat .NET packer of February 2021

Associated malware family: WSHRAT.

Targets: Windows PE.

It defines 6 patterns (0 text, 6 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-wshrat-dotnet-packer-feb21.yarDetection Rule License 1.1
rule SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21 : FILE
{
	meta:
		description = "Yara Rule for WSH rat .NET packer of February 2021 "
		author = "Yoroi Malware ZLab"
		id = "62e043fc-7d13-5b91-9fdd-e71d91194da2"
		date = "2021-03-09"
		modified = "2023-12-05"
		reference = "https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_wsh_rat.yar#L1-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "18159b140c314a00111fb9453e60d19c11633628a4fe2ad8299b839165b39424"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$a1 = { BE DD 60 8C 34 49 9A 54 D2 40 }
		$a2 = { 1D D7 24 22 47 A6 B1 A5 }
		$a3 = { 13 30 03 00 07 00 00 00 01 }
		$a4 = { 11 02 03 7D 78 00 00 04 2A }
		$a5 = { A8 8A F4 C8 61 2B CA 07 }
		$a6 = { 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}

	condition:
		uint16( 0 ) == 0x5A4D and 3 of them
}

Strings (6 patterns)

IdentifierTypeValueModifiers
$a1hex{ BE DD 60 8C 34 49 9A 54 D2 40 }
$a2hex{ 1D D7 24 22 47 A6 B1 A5 }
$a3hex{ 13 30 03 00 07 00 00 00 01 }
$a4hex{ 11 02 03 7D 78 00 00 04 2A }
$a5hex{ A8 8A F4 C8 61 2B CA 07 }
$a6hex{ 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}

Condition

uint16( 0 ) == 0x5A4D and 3 of them

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 3 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Yoroi Malware ZLab

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 62e043fc-7d13-5b91-9fdd-e71d91194da2

Tags:FILE

Related rules

More WSHRAT rules