Saltar al contenido
yararules.org
Menú

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1

This rule is intended match specific sequences of opcode found within TEARDROP, including those that decode the embedded payload. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory. (comment by Nextron: prone to False Positives)

APT / actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compila con YARA-X
Autor
FireEye
Fecha
2020-12-14
Modificada
2023-12-05
Puntuación / Calidad
70 / 85

Qué detecta esta regla

This rule is intended match specific sequences of opcode found within TEARDROP, including those that decode the embedded payload. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory. (comment by Nextron: prone to False Positives)

Objetivos: PE de Windows.

Define 5 patrones (0 de texto, 5 hex, 0 regex).

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar
apt-dropper-win64-teardrop-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1 : FILE
{
	meta:
		description = "This rule is intended match specific sequences of opcode found within TEARDROP, including those that decode the embedded payload. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory. (comment by Nextron: prone to False Positives)"
		author = "FireEye"
		id = "15dfdb74-5ca3-5bc6-be7a-730333b03ba5"
		date = "2020-12-14"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_solarwinds_sunburst.yar#L157-L174"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "a1fa9b9c700601d10cb77ec714b972f04308de615dfc519f680fc956227cc11d"
		score = 70
		quality = 85
		tags = "FILE"

	strings:
		$loc_4218FE24A5 = { 48 89 C8 45 0F B6 4C 0A 30 }
		$loc_4218FE36CA = { 48 C1 E0 04 83 C3 01 48 01 E8 8B 48 28 8B 50 30 44 8B 40 2C 48 01 F1 4C 01 FA }
		$loc_4218FE2747 = { C6 05 ?? ?? ?? ?? 6A C6 05 ?? ?? ?? ?? 70 C6 05 ?? ?? ?? ?? 65 C6 05 ?? ?? ?? ?? 67 }
		$loc_5551D725A0 = { 48 89 C8 45 0F B6 4C 0A 30 48 89 CE 44 89 CF 48 F7 E3 48 C1 EA 05 48 8D 04 92 48 8D 04 42 48 C1 E0 04 48 29 C6 }
		$loc_5551D726F6 = { 53 4F 46 54 57 41 52 45 ?? ?? ?? ?? 66 74 5C 43 ?? ?? ?? ?? 00 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

Cadenas (5 patrones)

IdentificadorTipoValorModificadores
$loc_4218FE24A5hex{ 48 89 C8 45 0F B6 4C 0A 30 }
$loc_4218FE36CAhex{ 48 C1 E0 04 83 C3 01 48 01 E8 8B 48 28 8B 50 30 44 8B 40 2C 48 01 F1 4C 01 FA }
$loc_4218FE2747hex{ C6 05 ?? ?? ?? ?? 6A C6 05 ?? ?? ?? ?? 70 C6 05 ?? ?? ?? ?? 65 C6 05 ?? ?? ?? ?? 67 }
$loc_5551D725A0hex{ 48 89 C8 45 0F B6 4C 0A 30 48 89 CE 44 89 CF 48 F7 E3 48 C1 EA 05 48 8D 04 92 48 8D 04 42 48 C1 E0 04 48 29 C6 }
$loc_5551D726F6hex{ 53 4F 46 54 57 41 52 45 ?? ?? ?? ?? 66 74 5C 43 ?? ?? ?? ?? 00 }

Condición

( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them

En palabras sencillas (Heurística)

  • El archivo debe empezar por «MZ»: un ejecutable de Windows (PE).
  • Debe coincidir al menos un patrón de la regla.

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

Licencia y atribución

Autor: FireEye

Repositorio de origen: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licencia: Detection Rule License 1.1 (licencia del repositorio)

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: 15dfdb74-5ca3-5bc6-be7a-730333b03ba5

Etiquetas:FILE

Reglas relacionadas