YARA · Volexity threat-intel
VOLEXITY_Apt_Malware_Macos_Gimmick
Detects the macOS port of the GIMMICK malware.
- Author
- threatintel@volexity.com
- Date
- 2021-10-18
- Modified
- 2024-08-02
- Score / Quality
- 75 / 78
What this rule detects
Detects the macOS port of the GIMMICK malware.
It defines 29 patterns (29 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
apt-malware-macos-gimmick.yarBSD 2-Clause License
rule VOLEXITY_Apt_Malware_Macos_Gimmick : STORMBAMBOO FILE MEMORY
{
meta:
= "Detects the macOS port of the GIMMICK malware."
= "threatintel@volexity.com"
= "3d485788-4aab-511b-a49e-5dc09d1950a9"
= "2021-10-18"
= "2024-08-02"
= "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/"
= "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2022/2022-03-22 GIMMICK/indicators/yara.yar#L1-L59"
= "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
= "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f"
= "00fba9df2212874a45d44b3d098a7b76c97fcd53ff083c76b784d2b510a4a467"
= 75
= 78
= "STORMBAMBOO, FILE, MEMORY"
= "darwin"
= "all"
= "file,memory"
= "critical"
= "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
= 6022
= 8
strings:
$s1 = "http://cgi1.apnic.net/cgi-bin/my-ip.php --connect-timeout 10 -m 20" wide ascii
$json1 = "base_json" ascii wide
$json2 = "down_json" ascii wide
$json3 = "upload_json" ascii wide
$json4 = "termin_json" ascii wide
$json5 = "request_json" ascii wide
$json6 = "online_json" ascii wide
$json7 = "work_json" ascii wide
$msg1 = "bash_pid: %d, FDS_CHILD: %d, FDS_PARENT: %d" ascii wide
$msg2 = "pid %d is dead" ascii wide
$msg3 = "exit with code %d" ascii wide
$msg4 = "recv signal %d" ascii wide
$cmd1 = "ReadCmdQueue" ascii wide
$cmd2 = "read_cmd_server_timer" ascii wide
$cmd3 = "enableProxys" ascii wide
$cmd4 = "result_block" ascii wide
$cmd5 = "createDirLock" ascii wide
$cmd6 = "proxyLock" ascii wide
$cmd7 = "createDirTmpItem" ascii wide
$cmd8 = "dowfileLock" ascii wide
$cmd9 = "downFileTmpItem" ascii wide
$cmd10 = "filePathTmpItem" ascii wide
$cmd11 = "uploadItems" ascii wide
$cmd12 = "downItems" ascii wide
$cmd13 = "failUploadItems" ascii wide
$cmd14 = "failDownItems" ascii wide
$cmd15 = "downloadCmds" ascii wide
$cmd16 = "uploadFiles" ascii wide
$cmd17 = "bash callback...." ascii wide
condition:
$s1 or 5 of ( $json* ) or 3 of ( $msg* ) or 9 of ( $cmd* )
}
Strings (29 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $s1 | text | "http://cgi1.apnic.net/cgi-bin/my-ip.php --connect-timeout 10 -m 20" | wide ascii |
| $json1 | text | "base_json" | ascii wide |
| $json2 | text | "down_json" | ascii wide |
| $json3 | text | "upload_json" | ascii wide |
| $json4 | text | "termin_json" | ascii wide |
| $json5 | text | "request_json" | ascii wide |
| $json6 | text | "online_json" | ascii wide |
| $json7 | text | "work_json" | ascii wide |
| $msg1 | text | "bash_pid: %d, FDS_CHILD: %d, FDS_PARENT: %d" | ascii wide |
| $msg2 | text | "pid %d is dead" | ascii wide |
| $msg3 | text | "exit with code %d" | ascii wide |
| $msg4 | text | "recv signal %d" | ascii wide |
| $cmd1 | text | "ReadCmdQueue" | ascii wide |
| $cmd2 | text | "read_cmd_server_timer" | ascii wide |
| $cmd3 | text | "enableProxys" | ascii wide |
| $cmd4 | text | "result_block" | ascii wide |
| $cmd5 | text | "createDirLock" | ascii wide |
| $cmd6 | text | "proxyLock" | ascii wide |
| $cmd7 | text | "createDirTmpItem" | ascii wide |
| $cmd8 | text | "dowfileLock" | ascii wide |
| $cmd9 | text | "downFileTmpItem" | ascii wide |
| $cmd10 | text | "filePathTmpItem" | ascii wide |
| $cmd11 | text | "uploadItems" | ascii wide |
| $cmd12 | text | "downItems" | ascii wide |
| $cmd13 | text | "failUploadItems" | ascii wide |
| $cmd14 | text | "failDownItems" | ascii wide |
| $cmd15 | text | "downloadCmds" | ascii wide |
| $cmd16 | text | "uploadFiles" | ascii wide |
| $cmd17 | text | "bash callback...." | ascii wide |
Condition
$s1 or 5 of ( $json* ) or 3 of ( $msg* ) or 9 of ( $cmd* )In plain words (Heuristic)
- At least 5 patterns in ( $json* ) must match.
- At least 3 patterns in ( $msg* ) must match.
- At least 9 patterns in ( $cmd* ) must match.
- Pattern $s1 must be present.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f
Licence & attribution
Author: threatintel@volexity.com
Source repository: Volexity threat-intel @ 3a9d0b5245
Licence: BSD 2-Clause License (stated in the rule's own meta)
“See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt”
Copyright notice: Copyright 2022 by Volexity, Inc.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 3d485788-4aab-511b-a49e-5dc09d1950a9
Metadata
| os | darwin |
|---|---|
| os_arch | all |
| scan_context | file,memory |
| severity | critical |
| rule_id | 6022 |
| version | 8 |
Related rules
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-07-21
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-08-17
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-23
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-23
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-07-24
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2020-03-16
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-07-30
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-03-30