YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_Socgholish_JS_22_02_2022

Detects SocGholish fake update Javascript files 22.02.2022

GenericSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Wojciech Cieślak
Date: 2022-02-22
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects SocGholish fake update Javascript files 22.02.2022

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

socgholish-js-22-02-2022.yarDetection Rule License 1.1

rule SIGNATURE_BASE_Socgholish_JS_22_02_2022 : FILE
{
	meta:
		description = "Detects SocGholish fake update Javascript files 22.02.2022"
		author = "Wojciech Cieślak"
		id = "68d2dbb7-0079-527a-92c7-450c3dd953b3"
		date = "2022-02-22"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_socgholish.yar#L53-L72"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "3e14d04da9cc38f371961f6115f37c30"
		hash = "dffa20158dcc110366f939bd137515c3"
		hash = "afee3af324951b1840c789540d5c8bff"
		hash = "c04a1625efec27fb6bbef9c66ca8372b"
		hash = "d08a2350df5abbd8fd530cff8339373e"
		logic_hash = "fd529cbb511ff6bcf37b44b835e021b28763922f7726ff67db5cbb3f9193c7ae"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "encodeURIComponent(''+" ascii
		$s2 = "['open']('POST'," ascii
		$s3 = "new ActiveXObject('MSXML2.XMLHTTP');" ascii

	condition:
		filesize < 5KB and all of them
}

Strings (3 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"encodeURIComponent(''+"	ascii
$s2	text	"['open']('POST',"	ascii
$s3	text	"new ActiveXObject('MSXML2.XMLHTTP');"	ascii

Condition

filesize < 5KB and all of them

In plain words (Heuristic)

The file must be smaller than 5KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/Neo23x0/signature-base

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

3e14d04da9cc38f371961f6115f37c30
dffa20158dcc110366f939bd137515c3
afee3af324951b1840c789540d5c8bff
c04a1625efec27fb6bbef9c66ca8372b
d08a2350df5abbd8fd530cff8339373e

Licence & attribution

Author: Wojciech Cieślak

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 68d2dbb7-0079-527a-92c7-450c3dd953b3

Tags:FILE