YARA · Trellix Advanced Research Center
TRELLIX_ARC_Hermeticwiper
Detecting variants of Hermetic Wiper malware discovered in UA
- Auteur
- cb @ Trellix ATR
- Date
- 2022-02-24
- Score / Qualité
- 75 / 70
Ce que détecte cette règle
Detecting variants of Hermetic Wiper malware discovered in UA
Famille de malware associée : Hermeticwiper.
Cibles : PE Windows.
Elle définit 11 motifs (0 texte, 11 hex, 0 regex).
Résumé généré à partir des métadonnées et de la condition de la règle.
Source de la règle
hermeticwiper.yarApache License 2.0
rule TRELLIX_ARC_Hermeticwiper : TROJAN FILE
{
meta:
= "Detecting variants of Hermetic Wiper malware discovered in UA"
= " cb @ Trellix ATR"
= "fc6d9238-b732-541d-b083-11b43fe8770d"
= "2022-02-24"
= "2022-02-24"
= "https://github.com/advanced-threat-research/Yara-Rules/"
= "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_Troj_HermWiper.yar#L1-L27"
= "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
= "b48e91afa19e09c7035ccda1b9293448e834d612b9a953b593f9412acb78faac"
= 75
= 70
= "TROJAN, FILE"
= "v1"
= "Trojan"
strings:
$0 = {E4B5518CD941310A015E4AF8E5968C8231492FE19246A293A569D5D7A36F56EB2FC5B68FFF6F3359C19AF6806920C3FE6628F90A75440E6616297A031BA6075100D72DFAA9829E772E45D77B89F862081EAFDB19B4B2DCEF3F273FF645ACCEAA4B991F98373973C0FB25829E860D9BC195EF1A0AD9219456AD077D42868EE03EE00E88D04C434BA97E88DF99273A35E2C668A1C69954B4762390ABDFBE4CD4AF}
$1 = {90506F1C825F7AE0D8605F5C627CA325BFF199AB60A63DE8A90E923F4B18D7FB039E1DEC89D573AAB0A14C1D4BA70EB444753A41C03082A60CB4DB551393F2C50988A3181E7F31D01B5AAD94070432D98F18655AB8A555919FEFEA9DE1EDF1}
$2 = {D5EEF61336015A85FF04ED298A6BDD6742FF153E33DAF9B383A5FFDCE7E64D47748DB5FF2609DF9BD5C66735FF6916797B2D365313FF1461EAEB9DAEA754FF6D4D55D1956CC8CBFF75C10CE74BF88C8DFF3B553B839D42609FFF2916227230}
$3 = {6C750DDC932124500CE9B5AB91CE101BE9AD348220E9423124512282373675152281023428825C51770FE9841F853375125382F732750A5B83F60FEB6AEE2282647462228269745AEE22826F7452228275744AEE2282787442}
$4 = {19A8A063FFAAAF6C1E7F78A896FFFA5C8F30BA98B69CFF1961E107BEB7636AFF9EA56A4FC4EDE3F1FF295235ACD0185726FFADA6B8CB54B342C9FF86F58524DC91617BFFB4388DBE01B6CF86}
$5 = {50C449606B20184A6328556032197660AAF9507861609F6160640560B4546160C3A194056070C4A09EC4A01A0461A4C4A0831B16600561916069A291607061C09160AA1CB6204A}
$6 = {FFEB19D2636B8B95273156BB63E8C78470D55970F47CF26574B46DE86EE084704590CA8053F15320258BBD1AACF18B04F2E965C6605CB10880B7E8FCF53DF5EB0621635EFF}
$7 = {7E31126E14B8FF98554F6FCFB64207FFCF8D93B2573609C2FF99E4409F73BB9322FF1E5E380DC0BBABCAFF4B901EDF61BD6A68FFEE3253728C7769ABFF7BCDA939C959A282}
$8 = {1970FFC6F8AA7C32EE693CFF369579E5355EF62CFF682CEAF20BA3EA1CFF1AAC638666431B20FF54293D1E709C231AFFCD11B55599F64CB9FF1E5A9015DC867F}
$9 = {8DFF93B2573609C299E4FF409F73BB93221E5EFF380DC0BBABCA4B90FF1EDF61BD6A68EE32FF53728C7769AB7BCDFFA939C959A282D312FF5DD04F0370CE811F}
$10 = {DF5519064E31101CF3DA96C15FF96728B708F358F51759E3A22FFA1CF1BB986A2038D6753E6BF037945B8469ADF20BAB71E10F3DE27735F640704C970DFE8672}
condition:
uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}
Chaînes (11 motifs)
| Identifiant | Type | Valeur | Modificateurs |
|---|---|---|---|
| $0 | hex | {E4B5518CD941310A015E4AF8E5968C8231492FE19246A293A569D5D7A36F56EB2FC5B68FFF6F3359C19AF6806920C3FE6628F90A75440E6616297A031BA6075100D72DFAA9829E772E45D77B89F8620 … | |
| $1 | hex | {90506F1C825F7AE0D8605F5C627CA325BFF199AB60A63DE8A90E923F4B18D7FB039E1DEC89D573AAB0A14C1D4BA70EB444753A41C03082A60CB4DB551393F2C50988A3181E7F31D01B5AAD94070432D … | |
| $2 | hex | {D5EEF61336015A85FF04ED298A6BDD6742FF153E33DAF9B383A5FFDCE7E64D47748DB5FF2609DF9BD5C66735FF6916797B2D365313FF1461EAEB9DAEA754FF6D4D55D1956CC8CBFF75C10CE74BF88C8 … | |
| $3 | hex | {6C750DDC932124500CE9B5AB91CE101BE9AD348220E9423124512282373675152281023428825C51770FE9841F853375125382F732750A5B83F60FEB6AEE2282647462228269745AEE22826F7452228 … | |
| $4 | hex | {19A8A063FFAAAF6C1E7F78A896FFFA5C8F30BA98B69CFF1961E107BEB7636AFF9EA56A4FC4EDE3F1FF295235ACD0185726FFADA6B8CB54B342C9FF86F58524DC91617BFFB4388DBE01B6CF86} | |
| $5 | hex | {50C449606B20184A6328556032197660AAF9507861609F6160640560B4546160C3A194056070C4A09EC4A01A0461A4C4A0831B16600561916069A291607061C09160AA1CB6204A} | |
| $6 | hex | {FFEB19D2636B8B95273156BB63E8C78470D55970F47CF26574B46DE86EE084704590CA8053F15320258BBD1AACF18B04F2E965C6605CB10880B7E8FCF53DF5EB0621635EFF} | |
| $7 | hex | {7E31126E14B8FF98554F6FCFB64207FFCF8D93B2573609C2FF99E4409F73BB9322FF1E5E380DC0BBABCAFF4B901EDF61BD6A68FFEE3253728C7769ABFF7BCDA939C959A282} | |
| $8 | hex | {1970FFC6F8AA7C32EE693CFF369579E5355EF62CFF682CEAF20BA3EA1CFF1AAC638666431B20FF54293D1E709C231AFFCD11B55599F64CB9FF1E5A9015DC867F} | |
| $9 | hex | {8DFF93B2573609C299E4FF409F73BB93221E5EFF380DC0BBABCA4B90FF1EDF61BD6A68EE32FF53728C7769AB7BCDFFA939C959A282D312FF5DD04F0370CE811F} | |
| $10 | hex | {DF5519064E31101CF3DA96C15FF96728B708F358F51759E3A22FFA1CF1BB986A2038D6753E6BF037945B8469ADF20BAB71E10F3DE27735F640704C970DFE8672} |
Condition
uint16( 0 ) == 0x5a4d and filesize < 200KB and all of themEn clair (Heuristique)
- Le fichier doit commencer par « MZ » — un exécutable Windows (PE).
- Le fichier doit faire moins de 200KB (garde-fou peu coûteux qui écarte les gros fichiers).
- Tous les motifs de la règle doivent être trouvés.
Tester cette règle dans votre navigateur
Déposez un fichier pour le scanner avec cette règle grâce à YARA-X compilé en WebAssembly. Rien n’est envoyé.
Déposez un fichier ici ou cliquez pour choisirScanné localement avec YARA-X. Fichiers jusqu’à 200 Mo.
Licence et attribution
Auteur : cb @ Trellix ATR
Dépôt source : Trellix Advanced Research Center @ 1919562a59
Licence : Apache License 2.0 (licence du dépôt)
Reprise via YARA Forge 20260927, qui préfixe les noms de règles par la source et ajoute des champs meta normalisés.
Identifiant de règle: fc6d9238-b732-541d-b083-11b43fe8770d
Métadonnées
| rule_version | v1 |
|---|---|
| malware_type | Trojan |
Règles liées
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-24
- CLUSTER25_UNC1222_Hermeticwiper_23433_10001Métadonnées seulesMalwareCluster25 (via Open-Source-YARA-rules)· Cluster25· 2022-02-23
- APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
- APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
- APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24
- MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-21
- MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-24