YARA · Volexity threat-intel
VOLEXITY_Apt_Malware_Py_Bluelight_Ldr
Python Loader used to execute the BLUELIGHT malware family.
- Author
- threatintel@volexity.com
- Date
- 2021-06-22
- Modified
- 2025-02-18
- Score / Quality
- 75 / 80
What this rule detects
Python Loader used to execute the BLUELIGHT malware family.
Associated malware family: Bluelight.
It defines 5 patterns (5 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
rule VOLEXITY_Apt_Malware_Py_Bluelight_Ldr : INKYPINE FILE
{
meta:
= "Python Loader used to execute the BLUELIGHT malware family."
= "threatintel@volexity.com"
= "db32b752-eba4-52a6-80b6-d1d394660453"
= "2021-06-22"
= "2025-02-18"
= "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
= "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L33-L61"
= "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
= "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
= "6987f5903561da8d4fa32c8d824593f601a49e13edfa2d617952d57ba3444f76"
= 75
= 80
= "INKYPINE, FILE"
= "win"
= "all"
= "file"
= "high"
= "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
= 5600
= 6
strings:
$s1 = "\"\".join(chr(ord(" ascii
$s2 = "import ctypes" ascii
$s3 = "ctypes.CFUNCTYPE(ctypes.c_int)" ascii
$s4 = "ctypes.memmove" ascii
$magic = "writelines(\"python ended\")" ascii
condition:
all of ( $s* ) or $magic
}
Strings (5 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $s1 | text | "\"\".join(chr(ord(" | ascii |
| $s2 | text | "import ctypes" | ascii |
| $s3 | text | "ctypes.CFUNCTYPE(ctypes.c_int)" | ascii |
| $s4 | text | "ctypes.memmove" | ascii |
| $magic | text | "writelines(\"python ended\")" | ascii |
Condition
all of ( $s* ) or $magicIn plain words (Heuristic)
- All patterns in ( $s* ) must match.
- Pattern $magic must be present.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
References
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120
Licence & attribution
Author: threatintel@volexity.com
Source repository: Volexity threat-intel @ 3a9d0b5245
Licence: BSD 2-Clause License (stated in the rule's own meta)
“See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt”
Copyright notice: Copyright 2022 by Volexity, Inc.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: db32b752-eba4-52a6-80b6-d1d394660453
Metadata
| os | win |
|---|---|
| os_arch | all |
| scan_context | file |
| severity | high |
| rule_id | 5600 |
| version | 6 |
Related rules
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-04-23
- APT / threat actorSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-04-23
- APT / threat actorSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-06-22
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-23
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-23
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-07-30