YARA · Trellix Advanced Research Center

TRELLIX_ARC_Hermeticwiper

Detecting variants of Hermetic Wiper malware discovered in UA

MalwareHermeticwiperTrellix Advanced Research CenterApache License 2.0Compila con YARA-X

Autor: cb @ Trellix ATR
Fecha: 2022-02-24
Puntuación / Calidad: 75 / 70

Qué detecta esta regla

Detecting variants of Hermetic Wiper malware discovered in UA

Familia de malware asociada: Hermeticwiper.

Objetivos: PE de Windows.

Define 11 patrones (0 de texto, 11 hex, 0 regex).

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar

hermeticwiper.yarApache License 2.0

rule TRELLIX_ARC_Hermeticwiper : TROJAN FILE
{
	meta:
		description = "Detecting variants of Hermetic Wiper malware discovered in UA"
		author = " cb @ Trellix ATR"
		id = "fc6d9238-b732-541d-b083-11b43fe8770d"
		date = "2022-02-24"
		modified = "2022-02-24"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_Troj_HermWiper.yar#L1-L27"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "b48e91afa19e09c7035ccda1b9293448e834d612b9a953b593f9412acb78faac"
		score = 75
		quality = 70
		tags = "TROJAN, FILE"
		rule_version = "v1"
		malware_type = "Trojan"

	strings:
		$0 = {E4B5518CD941310A015E4AF8E5968C8231492FE19246A293A569D5D7A36F56EB2FC5B68FFF6F3359C19AF6806920C3FE6628F90A75440E6616297A031BA6075100D72DFAA9829E772E45D77B89F862081EAFDB19B4B2DCEF3F273FF645ACCEAA4B991F98373973C0FB25829E860D9BC195EF1A0AD9219456AD077D42868EE03EE00E88D04C434BA97E88DF99273A35E2C668A1C69954B4762390ABDFBE4CD4AF}
		$1 = {90506F1C825F7AE0D8605F5C627CA325BFF199AB60A63DE8A90E923F4B18D7FB039E1DEC89D573AAB0A14C1D4BA70EB444753A41C03082A60CB4DB551393F2C50988A3181E7F31D01B5AAD94070432D98F18655AB8A555919FEFEA9DE1EDF1}
		$2 = {D5EEF61336015A85FF04ED298A6BDD6742FF153E33DAF9B383A5FFDCE7E64D47748DB5FF2609DF9BD5C66735FF6916797B2D365313FF1461EAEB9DAEA754FF6D4D55D1956CC8CBFF75C10CE74BF88C8DFF3B553B839D42609FFF2916227230}
		$3 = {6C750DDC932124500CE9B5AB91CE101BE9AD348220E9423124512282373675152281023428825C51770FE9841F853375125382F732750A5B83F60FEB6AEE2282647462228269745AEE22826F7452228275744AEE2282787442}
		$4 = {19A8A063FFAAAF6C1E7F78A896FFFA5C8F30BA98B69CFF1961E107BEB7636AFF9EA56A4FC4EDE3F1FF295235ACD0185726FFADA6B8CB54B342C9FF86F58524DC91617BFFB4388DBE01B6CF86}
		$5 = {50C449606B20184A6328556032197660AAF9507861609F6160640560B4546160C3A194056070C4A09EC4A01A0461A4C4A0831B16600561916069A291607061C09160AA1CB6204A}
		$6 = {FFEB19D2636B8B95273156BB63E8C78470D55970F47CF26574B46DE86EE084704590CA8053F15320258BBD1AACF18B04F2E965C6605CB10880B7E8FCF53DF5EB0621635EFF}
		$7 = {7E31126E14B8FF98554F6FCFB64207FFCF8D93B2573609C2FF99E4409F73BB9322FF1E5E380DC0BBABCAFF4B901EDF61BD6A68FFEE3253728C7769ABFF7BCDA939C959A282}
		$8 = {1970FFC6F8AA7C32EE693CFF369579E5355EF62CFF682CEAF20BA3EA1CFF1AAC638666431B20FF54293D1E709C231AFFCD11B55599F64CB9FF1E5A9015DC867F}
		$9 = {8DFF93B2573609C299E4FF409F73BB93221E5EFF380DC0BBABCA4B90FF1EDF61BD6A68EE32FF53728C7769AB7BCDFFA939C959A282D312FF5DD04F0370CE811F}
		$10 = {DF5519064E31101CF3DA96C15FF96728B708F358F51759E3A22FFA1CF1BB986A2038D6753E6BF037945B8469ADF20BAB71E10F3DE27735F640704C970DFE8672}

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

Cadenas (11 patrones)

Identificador	Tipo	Valor
$0	hex	{E4B5518CD941310A015E4AF8E5968C8231492FE19246A293A569D5D7A36F56EB2FC5B68FFF6F3359C19AF6806920C3FE6628F90A75440E6616297A031BA6075100D72DFAA9829E772E45D77B89F8620 …
$1	hex	{90506F1C825F7AE0D8605F5C627CA325BFF199AB60A63DE8A90E923F4B18D7FB039E1DEC89D573AAB0A14C1D4BA70EB444753A41C03082A60CB4DB551393F2C50988A3181E7F31D01B5AAD94070432D …
$2	hex	{D5EEF61336015A85FF04ED298A6BDD6742FF153E33DAF9B383A5FFDCE7E64D47748DB5FF2609DF9BD5C66735FF6916797B2D365313FF1461EAEB9DAEA754FF6D4D55D1956CC8CBFF75C10CE74BF88C8 …
$3	hex	{6C750DDC932124500CE9B5AB91CE101BE9AD348220E9423124512282373675152281023428825C51770FE9841F853375125382F732750A5B83F60FEB6AEE2282647462228269745AEE22826F7452228 …
$4	hex	{19A8A063FFAAAF6C1E7F78A896FFFA5C8F30BA98B69CFF1961E107BEB7636AFF9EA56A4FC4EDE3F1FF295235ACD0185726FFADA6B8CB54B342C9FF86F58524DC91617BFFB4388DBE01B6CF86}
$5	hex	{50C449606B20184A6328556032197660AAF9507861609F6160640560B4546160C3A194056070C4A09EC4A01A0461A4C4A0831B16600561916069A291607061C09160AA1CB6204A}
$6	hex	{FFEB19D2636B8B95273156BB63E8C78470D55970F47CF26574B46DE86EE084704590CA8053F15320258BBD1AACF18B04F2E965C6605CB10880B7E8FCF53DF5EB0621635EFF}
$7	hex	{7E31126E14B8FF98554F6FCFB64207FFCF8D93B2573609C2FF99E4409F73BB9322FF1E5E380DC0BBABCAFF4B901EDF61BD6A68FFEE3253728C7769ABFF7BCDA939C959A282}
$8	hex	{1970FFC6F8AA7C32EE693CFF369579E5355EF62CFF682CEAF20BA3EA1CFF1AAC638666431B20FF54293D1E709C231AFFCD11B55599F64CB9FF1E5A9015DC867F}
$9	hex	{8DFF93B2573609C299E4FF409F73BB93221E5EFF380DC0BBABCA4B90FF1EDF61BD6A68EE32FF53728C7769AB7BCDFFA939C959A282D312FF5DD04F0370CE811F}
$10	hex	{DF5519064E31101CF3DA96C15FF96728B708F358F51759E3A22FFA1CF1BB986A2038D6753E6BF037945B8469ADF20BAB71E10F3DE27735F640704C970DFE8672}

Condición

uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them

En palabras sencillas (Heurística)

El archivo debe empezar por «MZ»: un ejecutable de Windows (PE).
El archivo debe ocupar menos de 200KB (un límite barato que descarta archivos grandes).
Deben coincidir todos los patrones de la regla.

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

https://github.com/advanced-threat-research/Yara-Rules/

Licencia y atribución

Autor: cb @ Trellix ATR

Repositorio de origen: Trellix Advanced Research Center @ 1919562a59

Licencia: Apache License 2.0 (licencia del repositorio)

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: fc6d9238-b732-541d-b083-11b43fe8770d

Metadatos

rule_version	v1
malware_type	Trojan

Etiquetas:TROJAN FILE

MALPEDIA_Win_Hermeticwiper_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SEKOIA_Wiper_Hermeticwiper_Variants
MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-24
CLUSTER25_UNC1222_Hermeticwiper_23433_10001Solo metadatos
MalwareCluster25 (via Open-Source-YARA-rules)· Cluster25· 2022-02-23
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
APT / actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1
APT / actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24
TRELLIX_ARC_Chimera_Recordedtv_Modified
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-21
TRELLIX_ARC_Milum_Trojan
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-24

Más reglas de Hermeticwiper