Saltar al contenido
yararules.org
Menú

YARA · BlackBerry Research & Intelligence (via Open-Source-YARA-rules)

BLACKBERRY_Mal_Infostealer_Win32_Jupyter_Main_Module

Detects Jupter main module

MalwareBlackBerry Research & Intelligence (via Open-Source-YARA-rules)Apache License 2.0Compila con YARA-X
Autor
BlackBerry Threat Research Team
Fecha
2021-11-23
Modificada
2022-07-06
Puntuación / Calidad
75 / 83

Qué detecta esta regla

Detects Jupter main module

Objetivos: PE de Windows.

Define 21 patrones (1 de texto, 20 hex, 0 regex). Módulos YARA usados: pe.

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar

Incluye los imports necesarios para compilarla por sí sola.

mal-infostealer-win32-jupyter-main-module.yarApache License 2.0
import "pe"

rule BLACKBERRY_Mal_Infostealer_Win32_Jupyter_Main_Module
{
	meta:
		description = "Detects Jupter main module"
		author = "BlackBerry Threat Research Team"
		id = "b6c51dcc-bdf4-5960-b407-70379b948dc1"
		date = "2021-11-23"
		modified = "2022-07-06"
		reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_Win32_Jupyter_Main_Module.yar#L3-L42"
		license_url = "N/A"
		logic_hash = "bf14defaa9b0c514ddbdd4ed09b69a670d432dd30a3bbe4895ad7f9a796c1897"
		score = 75
		quality = 83
		tags = ""
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

	strings:
		$g1 = { 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 }
		$g2 = { 5C 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 5C 00 52 00 4F 00 41 00 4D 00 49 00 4E 00 47 }
		$g3 = { 63 00 68 00 61 00 6E 00 67 00 65 00 5F 00 73 00 74 00 61 00 74 00 75 00 73 }
		$g4 = { 50 00 4F 00 53 00 54 }
		$g5 = { 69 00 73 00 5F 00 73 00 75 00 63 00 63 00 65 00 73 00 73 }
		$g6 = { 75 00 73 00 65 00 72 00 70 00 72 00 6F 00 66 00 69 00 6C 00 65 }
		$g7 = { 44 00 45 00 53 00 4B 00 54 00 4F 00 50 00 2D }
		$g8 = { 4C 00 41 00 50 00 54 00 4F 00 50 00 2D }
		$g9 = { 78 00 38 00 36}
		$g10 = { 78 00 36 00 34 }
		$g11 = { 41 00 64 00 6D 00 69 00 6E }
		$g12 = { 56 00 69 00 73 00 74 00 61 }
		$g13 = { 64 00 6E 00 73 }
		$g14 = { 64 00 7A 00 6B 00 61 00 62 72 }
		$g15 = { 78 00 7A 00 6B 00 61 00 62 00 73 00 72 }
		$g16 = { 64 00 7A 00 6B 00 61 00 62 00 73 00 72 }
		$h1 = { 4F 00 43 00 2D }
		$h2 = { 4E 00 56 00 2D }
		$h3 = { 53 00 50 00 2D }
		$h4 = { 49 00 4E 00 2D }
		$i = "System.Net"

	condition:
		10 of ( $g* ) and 1 of ( $h* ) and ( pe.imports ( "mscoree.dll" , "_CorDllMain" ) or $i )
}

Cadenas (21 patrones)

IdentificadorTipoValorModificadores
$g1hex{ 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 }
$g2hex{ 5C 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 5C 00 52 00 4F 00 41 00 4D 00 49 00 4E 00 47 }
$g3hex{ 63 00 68 00 61 00 6E 00 67 00 65 00 5F 00 73 00 74 00 61 00 74 00 75 00 73 }
$g4hex{ 50 00 4F 00 53 00 54 }
$g5hex{ 69 00 73 00 5F 00 73 00 75 00 63 00 63 00 65 00 73 00 73 }
$g6hex{ 75 00 73 00 65 00 72 00 70 00 72 00 6F 00 66 00 69 00 6C 00 65 }
$g7hex{ 44 00 45 00 53 00 4B 00 54 00 4F 00 50 00 2D }
$g8hex{ 4C 00 41 00 50 00 54 00 4F 00 50 00 2D }
$g9hex{ 78 00 38 00 36}
$g10hex{ 78 00 36 00 34 }
$g11hex{ 41 00 64 00 6D 00 69 00 6E }
$g12hex{ 56 00 69 00 73 00 74 00 61 }
$g13hex{ 64 00 6E 00 73 }
$g14hex{ 64 00 7A 00 6B 00 61 00 62 72 }
$g15hex{ 78 00 7A 00 6B 00 61 00 62 00 73 00 72 }
$g16hex{ 64 00 7A 00 6B 00 61 00 62 00 73 00 72 }
$h1hex{ 4F 00 43 00 2D }
$h2hex{ 4E 00 56 00 2D }
$h3hex{ 53 00 50 00 2D }
$h4hex{ 49 00 4E 00 2D }
$itexto"System.Net"

Condición

10 of ( $g* ) and 1 of ( $h* ) and ( pe.imports ( "mscoree.dll" , "_CorDllMain" ) or $i )

En palabras sencillas (Heurística)

  • Deben coincidir al menos 10 patrones de ( $g* ).
  • Deben coincidir al menos 1 patrones de ( $h* ).
  • Usa el módulo pe.
  • El patrón $i debe estar presente.
  • Comprueba funciones o bibliotecas importadas.

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

Licencia y atribución

Autor: BlackBerry Threat Research Team

Repositorio de origen: BlackBerry Research & Intelligence (via Open-Source-YARA-rules) @ ec0056f767

Licencia: Apache License 2.0 (indicada en los metadatos de la regla)

“This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team”

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: b6c51dcc-bdf4-5960-b407-70379b948dc1

Reglas relacionadas