YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1

Detects SLOTHFULMEDIA malware

APT / actorSlothfulmediaSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compila con YARA-X

Autor: Florian Roth (Nextron Systems)
Fecha: 2020-10-01
Modificada: 2023-12-05
Puntuación / Calidad: 75 / 85

Qué detecta esta regla

Detects SLOTHFULMEDIA malware

Familia de malware asociada: Slothfulmedia.

Objetivos: PE de Windows.

Define 11 patrones (6 de texto, 5 hex, 0 regex).

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar

apt-mal-slothfulmedia-oct20-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1 : FILE
{
	meta:
		description = "Detects SLOTHFULMEDIA malware"
		author = "Florian Roth (Nextron Systems)"
		id = "cc413225-f084-5859-bc27-04eb018d8894"
		date = "2020-10-01"
		modified = "2023-12-05"
		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_iamtheking.yar#L2-L48"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273"
		hash = "927d945476191a3523884f4c0784fb71c16b7738bd7f2abd1e3a198af403f0ae"
		hash = "f0503f0131040b805e106eafe64a65d9404a0e279f052237b868e456c34d36e6"
		hash = "ed5258306c06d6fac9b13c99c7c8accc7f7fa0de4cf4de4f7d9eccad916555f5"
		hash = "04ca010f4c8997a023fabacae230698290e3ff918a86703c5e0a2a6983b039eb"
		hash = "cb2adcaaa25bb6b8a9f1c685c219f8d6d78aa5cfd65c633f4d255ff81da2c517"
		logic_hash = "e50bda40eb05767e0903c3d8dd62b4e0290d89740c82c8b7f391d5763dc35156"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$xc1 = { 25 73 26 69 3D 25 64 00 48 54 54 50 2F 31 2E 31
               00 00 00 00 50 4F 53 54 00 00 00 00 43 6F 6E 74
               65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 00 00
               5C 00 53 00 65 00 74 00 75 00 70 00 55 00 69 00
               00 00 00 00 25 00 73 00 25 00 73 00 5F 00 25 00
               64 00 2E 00 64 00 61 00 74 }
		$xc2 = { 2F 76 3F 6D 3D 00 00 00 35 30 31 00 32 30 30 00
               2A 00 2E 00 2A 00 00 00 25 00 73 00 00 00 00 00
               53 00 65 00 44 00 65 00 62 00 75 00 67 00 50 00
               72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 }
		$xc3 = { 00 25 00 73 00 7C 00 25 00 73 00 7C 00 25 00 73
               00 7C 00 25 00 73 00 00 00 5C 00 46 00 69 00 6C
               00 74 00 65 00 72 00 33 00 2E 00 6A 00 70 00 67 }
		$sc1 = { 25 74 65 6D 70 25 00 00 25 73 5C 25 73 2E 65 78
               65 00 00 00 25 74 65 6D 70 25 00 00 25 73 5C 25
               73 2E 65 78 65 }
		$sc2 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65
               74 2D 73 74 72 65 61 6D 2C 61 70 70 6C 69 63 61
               74 69 6F 6E 2F 78 68 74 6D 6C 00 00 25 73 26 69
               3D 25 64 00 48 54 54 50 2F 31 2E 31 00 00 00 00
               50 4F 53 54 }
		$s1 = "%s%s_%d.dat" wide fullword
		$s2 = "Local Security Process" wide fullword
		$s3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" ascii fullword
		$s4 = "Global%s%d" wide fullword
		$s5 = "ExtKeyloggerStart" ascii fullword
		$s6 = "GetExtendedTcpTable" ascii fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
}

Cadenas (11 patrones)

Identificador	Tipo	Valor	Modificadores
$xc1	hex	{ 25 73 26 69 3D 25 64 00 48 54 54 50 2F 31 2E 31 00 00 00 00 50 4F 53 54 00 00 00 00 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A …
$xc2	hex	{ 2F 76 3F 6D 3D 00 00 00 35 30 31 00 32 30 30 00 2A 00 2E 00 2A 00 00 00 25 00 73 00 00 00 00 00 53 00 65 00 44 00 65 00 62 00 75 …
$xc3	hex	{ 00 25 00 73 00 7C 00 25 00 73 00 7C 00 25 00 73 00 7C 00 25 00 73 00 00 00 5C 00 46 00 69 00 6C 00 74 00 65 00 72 00 33 00 2E 00 …
$sc1	hex	{ 25 74 65 6D 70 25 00 00 25 73 5C 25 73 2E 65 78 65 00 00 00 25 74 65 6D 70 25 00 00 25 73 5C 25 73 2E 65 78 65 }
$sc2	hex	{ 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 2C 61 70 70 6C 69 63 61 74 69 6F 6E 2F 78 68 74 6D 6C 00 …
$s1	texto	"%s%s_%d.dat"	wide fullword
$s2	texto	"Local Security Process"	wide fullword
$s3	texto	"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75"	ascii fullword
$s4	texto	"Global%s%d"	wide fullword
$s5	texto	"ExtKeyloggerStart"	ascii fullword
$s6	texto	"GetExtendedTcpTable"	ascii fullword

Condición

uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them

En palabras sencillas (Heurística)

El archivo debe empezar por «MZ»: un ejecutable de Windows (PE).
El archivo debe ocupar menos de 400KB (un límite barato que descarta archivos grandes).
Deben coincidir al menos 1 patrones de ( $x* ).
Deben coincidir al menos 3 patrones de la regla.
Deben coincidir al menos 4 patrones de la regla.

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a

Hashes de muestras

Hashes de las muestras que el autor lista en los metadatos de la regla (búscalos en tu plataforma de threat intelligence).

64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273
927d945476191a3523884f4c0784fb71c16b7738bd7f2abd1e3a198af403f0ae
f0503f0131040b805e106eafe64a65d9404a0e279f052237b868e456c34d36e6
ed5258306c06d6fac9b13c99c7c8accc7f7fa0de4cf4de4f7d9eccad916555f5
04ca010f4c8997a023fabacae230698290e3ff918a86703c5e0a2a6983b039eb
cb2adcaaa25bb6b8a9f1c685c219f8d6d78aa5cfd65c633f4d255ff81da2c517

Licencia y atribución

Autor: Florian Roth (Nextron Systems)

Repositorio de origen: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licencia: Detection Rule License 1.1 (licencia del repositorio)

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: cc413225-f084-5859-bc27-04eb018d8894

Etiquetas:FILE

MALPEDIA_Win_Slothfulmedia_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
DITEKSHEN_MALWARE_Win_Slothfulmedia
MalwareditekSHen detection· ditekSHen· 2020-11-06
ARKBIRD_SOLG_MAL_Slothfulmedia_Jul_2021_1Solo metadatos
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-09
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1
APT / actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25

Más reglas de Slothfulmedia