YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_BAT_Aux_Jan20_1

Detects BAT file often dropped to cleanup temp dirs during infection

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2020-01-29
Modified: 2023-12-05
Score / Quality: 65 / 85

What this rule detects

Detects BAT file often dropped to cleanup temp dirs during infection

It defines 5 patterns (5 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

susp-bat-aux-jan20-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_SUSP_BAT_Aux_Jan20_1 : FILE
{
	meta:
		description = "Detects BAT file often dropped to cleanup temp dirs during infection"
		author = "Florian Roth (Nextron Systems)"
		id = "c97f189e-a0c2-532e-b087-8669da72a2ad"
		date = "2020-01-29"
		modified = "2023-12-05"
		reference = "https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_bat_aux.yar#L2-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "f5d558ec505b635b1e37557350562ad6f79b3da5cf2cf74db6e6e648b7a47127"
		logic_hash = "6b8cd9b7683a18a02a81222d6819fe903500702c83f198f73ac428d1bc91fb9a"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "if exist \"C:\\Users\\" ascii
		$s2 = "\\AppData\\Local\\Temp\\" ascii
		$s3 = "del \"C:\\Users\\" ascii
		$s4 = ".bat\"" ascii
		$s5 = ".exe\" goto" ascii

	condition:
		uint8( 0 ) == 0x3a and filesize <= 1KB and all of them
}

Strings (5 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"if exist \"C:\\Users\\"	ascii
$s2	text	"\\AppData\\Local\\Temp\\"	ascii
$s3	text	"del \"C:\\Users\\"	ascii
$s4	text	".bat\""	ascii
$s5	text	".exe\" goto"	ascii

Condition

uint8( 0 ) == 0x3a and filesize <= 1KB and all of them

In plain words (Heuristic)

The file must be smaller than 1KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

f5d558ec505b635b1e37557350562ad6f79b3da5cf2cf74db6e6e648b7a47127

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: c97f189e-a0c2-532e-b087-8669da72a2ad

Tags:FILE

SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-09-17
SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-04-06
SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-06-27
SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-06-10
SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-10
SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-10-12
SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-08-25
SIGNATURE_BASE_SUSP_Jdniexploit_Error_Indicators_Dec21_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-10