YARA · Trellix Advanced Research Center

TRELLIX_ARC_APT_Winnti

Detects Winnti variants

APT / threat actorWinntiTrellix Advanced Research CenterApache License 2.0Compiles with YARA-X

Author: McAfee ATR Team
Date: 2020-06-04
Modified: 2020-10-14
Score / Quality: 75 / 70

What this rule detects

Detects Winnti variants

Associated malware family: Winnti.

Targets: Windows PE.

It defines 1 patterns (0 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-winnti.yarApache License 2.0

rule TRELLIX_ARC_APT_Winnti : BACKDOOR FILE
{
	meta:
		description = "Detects Winnti variants"
		author = "McAfee ATR Team"
		id = "f12b039a-2508-580f-b777-428bbda2c666"
		date = "2020-06-04"
		modified = "2020-10-14"
		reference = "https://attack.mitre.org/software/S0141/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_winnti.yar#L1-L27"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "fd539d345821d9ac9b885811b1f642aa1817ba8501d47bc1de575f5bef2fbf9e"
		logic_hash = "f94b2c552fbb30e1005e5c75a2f449d60b9558a0916197bed41bf32c6477daef"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Winnti"
		actor_type = "Apt"
		actor_group = "Unknown"

	strings:
		$pattern = { 9090909090909090909090909090C7????????????C2????90909090909081??????????E9????????CCCCCCCCCC8A??????8B??????538A??8A??568B??578B??????8B??C1????66????8B??C1????F3AB8B??83????F3AA8B??5F5E5BC390909090909090909090909090909083????5333??568D??????535089??????89??????E8????????8A??33??3A??8D??????0F94??83????5389??????528B??89??????C6????????E8????????8B??33??81??????????8D??????0F94??6A??89??????5223??89??????C6????????C6????????E8????????33??66????8D??????6A??0F94??89??????89??????5223??C6????????C6????????E8????????8B??83????33??3B??0F94??23??5E495BF7??1B??8B??83????C38B??????8B??????03??C390909090908B??????85??0F84????????8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??E9????????83????C39090909090909090909090909083????8B??????53558B??????33??568B??????83????5789??????76??81??????????8B??76??BF????????8B??????8D????03??C1????03??89??????3B??76??8B??????68????????6A??52E8????????8B??????8B??????8B??????505351565752E8????????8B??????8B??8B??????2B??8B??83????03??8B??????83????89??????77??03??0F84????????8B??????8B??????2B??03??3B??89??????75??81??????????77??8A??04??EB??83????77??08????EB??83????77??8A??80????88??EB??8D????C6????463D????????89??????76??8D????B8????????F7??C1????8B??33??8B??8B??C1????F3AB8B??83????03??F3AA8B??????81??????????4A89??????75??8B??????8B??88??468A??88??46424B75??8B??????C6????465FC6????46C6????2B??8B??????4633??89??5E5D5B83????C390909090909090909083????8B??????53558B??????568B??????8D????5789??????8B??????83????73??B8????????2B??EB??33??03??8B??2B??C1????8D??????89??????8B??????8B??????8D????3B??0F83????????8B??8B??69??????????8B??????8B??????C1????33??66??????03??8B??????2B??????89??????66??????8B??3B??0F85????????8B??????C7??????????????2B??8B??????8B??2B??0F84????????83????77??8A????0A??88????8B????89??03??E9????????83????77??8A??2C??88??468B????89??8B????89????8B????89????8B????89????03??E9????????83????77??8A??80????88??46EB??8D????C6????463D????????89??????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??8B??????81??????????4889??????75??8B??????8B??8B??????88??468B????89??8B????89????8B????89????8B????89????83????83????83????83????73??85??76??8A????88??46454B75??BB????????8B????8B????33??75??BB????????03??8B????8B??33??8B??????83????3B??73??8B??2B??????85??75??83????83????8B????8B??33??8B??????3B??72??EB??84??75??C1????4384??74??8B??????8B??03??2B??83????89??????77??3D????????77??4880????8A??80????C0????C0????0A??88??46C1????88??46E9????????3D????????77??4883????89??????77??80????80????EB??83????C6????4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????2D????????83????89??????77??8B??80????C1????80????8A??0A??80????88??46C0????88??46C1????88??46E9????????8B??83????C1????80????80????88??4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????8B??????E9????????8B??????8B??????8B??????2B??89??8B??5F2B??5E5D03??5B83????C390909090909090909090908B??????538B??????55568B??????C7??????????578A??8D????8B??????80????8B??76??81??????????8D????83????8B??83????0F82????????8A??88??40414F75??EB??33??8A??418B??83????0F83????????85??75??80????75??8A????81??????????4184??74??33??8A??418D??????8B??89??83????83????4E74??83????72??8B??89??83????83????83????83????73??85??76??8A??88??40414E75??EB??8A??88??40414E75??33??8A??418B??83????73??33??8B??8A??C1????2B??C1????2B??8A??????????81??????????4188??40478A??88??8A????4088??408A????83????8B??0F84????????8A??88??404183????76??8A??88??404183????76??8A??88??404133??8A??418B??83????72??8B??8B??C1????83????2B??33??8A??C1????2B??4F41C1????4E8A??88??8A????404788??40478A??88??40474E75??EB??83????72??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????8D????66????81??????????C1????2B??83????EB??83????0F82????????8B??8B??83????C1????2B??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????66????81??????????C1????2B??83????3B??74??81??????????83????0F82????????8B??2B??83????0F8C????????8B??89??83????83????83????8B??89??83????83????83????83????73??85??0F86????????8A??88??40474E75??E9????????33??8B??8A??C1????2B??C1????2B??4F41E9????????8B??????2B??3B??89??75??5F5E5D33??5BC31B??5F24??5E5D83????5BC39090909090909090909090909081??????????568B??68????????C7??????????FF??????????83????75??57B9????????33??8D??????66????????????F3AB66AB8D??????5068????????FF??????????83????5F75??6A??68????????FF??????????8B??5E81??????????C390909090909090909090909090568B??E8????????F6????????74??56E8????????83????8B??5EC2????909068????????C7??????????FF??????????85??75??FF??????????C39090909053558B??????5685??5774??8B??????85??74??33??33??33??85??76??8A??????????8A??????????32??80????32??8A????32??33??88????8D????BE????????F7??8D????BF????????8B??33??F7??413B??8B??72??5F5E5D5BC39083????538B??????55565768????????68????????5333??FF??????????8B??85??0F84????????68????????FF??????????8B??B0??88??????88??????8D??????B1??5056C6????????88??????C6????????C6????????C6????????C6????????88??????C6????????C6????????C6????????C6????????FF??????????5753FF??568B??FF??????????85??74??57FF??????????8B??8B??????B9????????8B??68????????50F3A5E8????????83????B8????????5F5E5D5B83????C35F8B??5E5D5B83????C39090538B??????????5657C7??????????8D????BF???????? }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

Strings (1 patterns)

Identifier	Type	Value	Modifiers
$pattern	hex	{ 9090909090909090909090909090C7????????????C2????90909090909081??????????E9????????CCCCCCCCCC8A??????8B??????538A??8A??568B??578B??????8B??C1????66????8B??C1?? …

Condition

uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 400KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://attack.mitre.org/software/S0141/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

fd539d345821d9ac9b885811b1f642aa1817ba8501d47bc1de575f5bef2fbf9e

Licence & attribution

Author: McAfee ATR Team

Source repository: Trellix Advanced Research Center @ 1919562a59

Licence: Apache License 2.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: f12b039a-2508-580f-b777-428bbda2c666

Metadata

rule_version	v1
malware_type	backdoor
malware_family	Backdoor:W32/Winnti
actor_type	Apt
actor_group	Unknown

Tags:BACKDOOR FILE

SIGNATURE_BASE_APT_Winnti_MAL_Dec19_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06
SIGNATURE_BASE_APT_Winnti_MAL_Dec19_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06
SIGNATURE_BASE_APT_Winnti_MAL_Dec19_3
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06
SIGNATURE_BASE_APT_Winnti_MAL_Dec19_4
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06
SIGNATURE_BASE_APT_Winnti_MAL_Dec19_5
APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06
SIGNATURE_BASE_HKTL_Redmimicry_Winntiloader
Hack toolSignature Base (Florian Roth / Nextron)· mirar@chaosmail.org· 2020-06-22
MALPEDIA_Win_Winnti_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
TRELLIX_ARC_APT_Acidbox_Main_Module_Dll
APT / threat actorTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-07-24

More Winnti rules