YARA · Synacktiv rules

SYNACKTIV_SYNACKTIV_WEBSHELL_ASPX_Suo5_May25

Detects the .NET version of the suo5 webshell

WebshellSynacktiv rulesDetection Rule License 1.1Compiles with YARA-X

Author: Synacktiv, Maxence Fossat [@cybiosity]
Date: 2025-05-12
Score / Quality: 75 / 80

What this rule detects

Detects the .NET version of the suo5 webshell

It defines 18 patterns (17 text, 0 hex, 1 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

synacktiv-webshell-aspx-suo5-may25.yarDetection Rule License 1.1

rule SYNACKTIV_SYNACKTIV_WEBSHELL_ASPX_Suo5_May25 : WEBSHELL COMMODITY FILE
{
	meta:
		description = "Detects the .NET version of the suo5 webshell"
		author = "Synacktiv, Maxence Fossat [@cybiosity]"
		id = "d30a7232-f00b-45ab-9419-f43b1611445a"
		date = "2025-05-12"
		modified = "2025-05-12"
		reference = "https://www.synacktiv.com/en/publications/open-source-toolset-of-an-ivanti-csa-attacker"
		source_url = "https://github.com/synacktiv/synacktiv-rules/blob/d234cc4da0783db7dca56ae8dd5252afdc248df8/2025/offensive_tools/webshell_aspx_suo5.yar#L1-L46"
		license_url = "https://github.com/synacktiv/synacktiv-rules/blob/d234cc4da0783db7dca56ae8dd5252afdc248df8/LICENSE.md"
		hash = "06710575d20cacd123f83eb82994879367e07f267e821873bf93f4db6312a97b"
		hash = "e6979d7df0876679fc2481aa68fcec5b6ddc82d854f63da2bddb674064384f9a"
		hash = "3bbbef1b4ead98c61fba60dd6291fe1ff08f5eac54d820e47c38d348e4a7b1ec"
		hash = "345c383dd439eb523b01e1087a0866e13f04ff53bb8cc11f3c70b4a382f10c7e"
		hash = "838840dd76ff34cee45996fdc9a87856c9a0f14138e65cb9eb6603ed157d1515"
		hash = "d9657ac8dd562bdd39e8fcc1fff37ddced10f7f3f118d9cd4da6118a223dcc45"
		logic_hash = "68dc29b2cedc26e638eaa12bf2a2d0415de323097baf5ea61dba52bd20b5beee"
		score = 75
		quality = 80
		tags = "WEBSHELL, COMMODITY, FILE"
		license = "DRL-1.1"
		tlp = "TLP:CLEAR"
		pap = "PAP:CLEAR"

	strings:
		$user_agent = ".Equals(\"Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.1.2.3\")" ascii
		$header = "Response.AddHeader(\"X-Accel-Buffering\", \"no\")" ascii
		$xor = /= \(byte\)\(\w{1,1023}\[\w{1,1023}\] \^ \w{1,1023}\);/
		$s1 = "Request.Headers.Get(\"User-Agent\")" ascii
		$s2 = "if (Request.ContentType.Equals(\"application/plain\"))" ascii
		$s3 = "Response.ContentType = \"application/octet-stream\";" ascii
		$s4 = "= Request.BinaryRead(Request.ContentLength);" ascii
		$s5 = "= Response.OutputStream;" ascii
		$s6 = "new TcpClient()" ascii
		$s7 = ".BeginConnect(" ascii
		$s8 = ".GetStream().Write(" ascii
		$s9 = "new BinaryWriter(" ascii
		$s10 = "new BinaryReader(" ascii
		$s11 = ".ReadBytes(4)" ascii
		$s12 = "BitConverter.GetBytes((Int32)" ascii
		$s13 = "BitConverter.ToInt32(" ascii
		$s14 = "Array.Reverse(" ascii
		$s15 = "new Random().NextBytes(" ascii

	condition:
		filesize < 100KB and ( $user_agent or ( ( $header or $xor ) and 8 of ( $s* ) ) or 12 of ( $s* ) )
}

Strings (18 patterns)

Identifier	Type	Value	Modifiers
$user_agent	text	".Equals(\"Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.1.2.3\")"	ascii
$header	text	"Response.AddHeader(\"X-Accel-Buffering\", \"no\")"	ascii
$xor	regex	/= $byte$$\w{1,1023}\[\w{1,1023}\] \^ \w{1,1023}$;/
$s1	text	"Request.Headers.Get(\"User-Agent\")"	ascii
$s2	text	"if (Request.ContentType.Equals(\"application/plain\"))"	ascii
$s3	text	"Response.ContentType = \"application/octet-stream\";"	ascii
$s4	text	"= Request.BinaryRead(Request.ContentLength);"	ascii
$s5	text	"= Response.OutputStream;"	ascii
$s6	text	"new TcpClient()"	ascii
$s7	text	".BeginConnect("	ascii
$s8	text	".GetStream().Write("	ascii
$s9	text	"new BinaryWriter("	ascii
$s10	text	"new BinaryReader("	ascii
$s11	text	".ReadBytes(4)"	ascii
$s12	text	"BitConverter.GetBytes((Int32)"	ascii
$s13	text	"BitConverter.ToInt32("	ascii
$s14	text	"Array.Reverse("	ascii
$s15	text	"new Random().NextBytes("	ascii

Condition

filesize < 100KB and ( $user_agent or ( ( $header or $xor ) and 8 of ( $s* ) ) or 12 of ( $s* ) )

In plain words (Heuristic)

The file must be smaller than 100KB (a cheap guard that skips large files).
At least 8 patterns in ( $s* ) must match.
At least 12 patterns in ( $s* ) must match.
Pattern $user_agent must be present.
Pattern $header must be present.
Pattern $xor must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.synacktiv.com/en/publications/open-source-toolset-of-an-ivanti-csa-attacker

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

06710575d20cacd123f83eb82994879367e07f267e821873bf93f4db6312a97b
e6979d7df0876679fc2481aa68fcec5b6ddc82d854f63da2bddb674064384f9a
3bbbef1b4ead98c61fba60dd6291fe1ff08f5eac54d820e47c38d348e4a7b1ec
345c383dd439eb523b01e1087a0866e13f04ff53bb8cc11f3c70b4a382f10c7e
838840dd76ff34cee45996fdc9a87856c9a0f14138e65cb9eb6603ed157d1515
d9657ac8dd562bdd39e8fcc1fff37ddced10f7f3f118d9cd4da6118a223dcc45

Licence & attribution

Author: Synacktiv, Maxence Fossat [@cybiosity]

Source repository: Synacktiv rules @ d234cc4da0

Licence: Detection Rule License 1.1 (stated in the rule's own meta)

“DRL-1.1”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: d30a7232-f00b-45ab-9419-f43b1611445a

Metadata

tlp	TLP:CLEAR
pap	PAP:CLEAR

Tags:WEBSHELL COMMODITY FILE

SYNACKTIV_SYNACKTIV_HKTL_Tunnel_GO_Iox_May25
Hack toolSynacktiv rules· Synacktiv, Maxence Fossat [@cybiosity]· 2025-05-12
SYNACKTIV_SYNACKTIV_HKTL_Tunnel_X64_GO_Iox_May25
Hack toolSynacktiv rules· Synacktiv, Maxence Fossat [@cybiosity]· 2025-05-12