YARA · Signature Base (Florian Roth / Nextron)
SIGNATURE_BASE_SUSP_RDP_File_Indicators_Oct24_1
Detects characteristics found in malicious RDP files used as email attachments in spear phishing campaigns
- Author
- Florian Roth
- Date
- 2024-10-25
- Modified
- 2024-12-12
- Score / Quality
- 75 / 85
What this rule detects
Detects characteristics found in malicious RDP files used as email attachments in spear phishing campaigns
It defines 5 patterns (5 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
rule SIGNATURE_BASE_SUSP_RDP_File_Indicators_Oct24_1 : FILE
{
meta:
= "Detects characteristics found in malicious RDP files used as email attachments in spear phishing campaigns"
= "Florian Roth"
= "16128c1e-64ed-5a3e-ad1e-e0330d91f5a9"
= "2024-10-25"
= "2024-12-12"
= "https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/"
= "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nobellium_rdp_phish.yar#L2-L24"
= "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
= "280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0"
= "8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5"
= "9b8cb8b01ce4eafb9204250a3c28bfaf70cc76a99ce411ad52bbf1aa2b6cce34"
= "ba4d58f2c5903776fe47c92a0ec3297cc7b9c8fa16b3bf5f40b46242e7092b46"
= "f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8"
= "55bd63738c38719ce7aeb874956488b0d3f7167a31d880ee61994b5921bd1458"
= 75
= 85
= "FILE"
strings:
$s1 = "redirectclipboard:i:1" wide fullword
$s2 = "redirectprinters:i:1" wide fullword
$s3 = "remoteapplicationmode:i:1" wide fullword
$s4 = "username:s:" wide
$s5 = "emoteapplicationicon:s:C:\\Windows\\SystemApps" wide
condition:
filesize < 50KB and all of them
}
Strings (5 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $s1 | text | "redirectclipboard:i:1" | wide fullword |
| $s2 | text | "redirectprinters:i:1" | wide fullword |
| $s3 | text | "remoteapplicationmode:i:1" | wide fullword |
| $s4 | text | "username:s:" | wide |
| $s5 | text | "emoteapplicationicon:s:C:\\Windows\\SystemApps" | wide |
Condition
filesize < 50KB and all of themIn plain words (Heuristic)
- The file must be smaller than 50KB (a cheap guard that skips large files).
- All patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0
- 8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5
- 9b8cb8b01ce4eafb9204250a3c28bfaf70cc76a99ce411ad52bbf1aa2b6cce34
- ba4d58f2c5903776fe47c92a0ec3297cc7b9c8fa16b3bf5f40b46242e7092b46
- f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8
Licence & attribution
Author: Florian Roth
Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a
Licence: Detection Rule License 1.1 (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 16128c1e-64ed-5a3e-ad1e-e0330d91f5a9
Tags:FILE
Related rules
- Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23
- Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23
- Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23
- Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-08-04
- Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23
- Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2025-08-07
- Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2025-02-14
- Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-07-12