Aller au contenu
yararules.org
Menu

YARA · Trellix Advanced Research Center

TRELLIX_ARC_Milum_Trojan

Rule to detect Milum trojan from the Wildpressure operation

MalwareMilumTrellix Advanced Research CenterApache License 2.0Compile avec YARA-X
Auteur
Marc Rivero | McAfee ATR Team
Date
2020-04-24
Modifiée
2020-08-14
Score / Qualité
75 / 70

Ce que détecte cette règle

Rule to detect Milum trojan from the Wildpressure operation

Famille de malware associée : Milum.

Cibles : PE Windows.

Elle définit 1 motifs (0 texte, 1 hex, 0 regex). Modules YARA utilisés : pe.

Résumé généré à partir des métadonnées et de la condition de la règle.

Source de la règle

Télécharger .yar

Inclut les imports nécessaires pour la compiler seule.

milum-trojan.yarApache License 2.0
import "pe"

rule TRELLIX_ARC_Milum_Trojan : TROJAN FILE
{
	meta:
		description = "Rule to detect Milum trojan from the Wildpressure operation"
		author = "Marc Rivero | McAfee ATR Team"
		id = "acc56237-a93a-55c0-a90c-11ca1da683db"
		date = "2020-04-24"
		modified = "2020-08-14"
		reference = "https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_milum_wildpressure.yar#L3-L28"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9"
		logic_hash = "3ab1ff129517cb4a829edac289c00d7701d6f667ba2ef5a28024fd01a3a52e8e"
		score = 75
		quality = 70
		tags = "TROJAN, FILE"
		rule_version = "v1"
		malware_type = "trojan"
		malware_family = "Trojan:W32/Milum"
		actor_type = "Apt"
		actor_group = "Unknown"

	strings:
		$pattern = { 558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????89??????????C7????????????8D????C7??????????33??6A??89??????????89????E8????????83????3B??0F84????????89????89??8B????89????8B????89????8B????C6??????8B????C6??????C6??????8B??????????BE????????89????89????88????C6??????6A??68????????8D??????????89??????????89??????????88??????????E8????????C6??????6A??538D????528D??????????89??????????89??????????88??????????E8????????C6??????8D??????????508B??E8????????508D??????????5157E8????????C6??????83????????????72??8B??????????52E8????????83????89??????????89??????????88??????????C6??????83????????????72??8B??????????50E8????????83????6A??68????????8D????89??????????89??????????88??????????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????83??????72??8B????51E8????????83????89????89????88????C6??????83??????72??8B????52E8????????83????6A??68????????8D????89????89????88????89????89????88????E8????????C6??????6A??538D????508D????89????89????88????E8????????C6??????83????8B??89??????????6A??89????89????68????????88??E8????????C6??????83????8B??89??????????6A??538D????89????89????5288??E8????????C6??????8D??????????50C6??????E8????????83????C6??????8B??????????2B??????????B8????????F7??03??C1????8B??C1????03??83????75??8B??????????6A??53528D????E8????????8B??????????6A??83????53508D????E8????????6A??538D????508D????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????BF????????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????8B??????????3B??74??8B??????????E8????????8B??????????50E8????????83????BF????????89??????????89??????????89??????????C6??????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????39????72??8B????50E8????????83????89????89????88????88????39????72??8B????51E8????????83????89????89????88????C7????????????39????72??8B????52E8????????83????8B??????????89????89????88????8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????8D??????????508D??????????89??????????E8????????C6??????C7??????????????????C6??????68????????8D??????????51E8????????CCCC558B??6A??68????????64??????????5051535657A1????????33??508D????64??????????8B????C7??????????C7????????????8D????33??83??????89????72??8B??EB??8B??8D????88??8B????8B????518B??E8????????8B????89????8B????89??8B????89????89????88????83??????72??8B??50E8????????83????89????C7????????????88??83????89????89????C7????????????8B????8B??50518D????E8????????89????8B????52E8????????83????8B????64????????????595F5E5B8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????505156A1????????33??508D????64??????????83????C7????????????8B????5156E8????????C7????????????C7????????????8B??8B????64????????????595E8B??5DC2????CCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????33??8B??89??????????8B????8B??89??????????89??????????89??????????3B??0F84????????8D????39??????????0F85????????68????????8D????5750E8????????C7????????????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????E9????????578D????68????????51E8????????C7????????????508D??????????52BA????????E8????????C6??????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????C6??????39??????????72??8B??????????50E8????????83????C7??????????????????89??????????88??????????88????39????72??8B????51E8????????83????C7????????????89????88????FF??????????38????75??8B????38????75??8B??8B??38????75??8D????8B??8B??38????74??EB??8B????38????75??3B????75??8B??8B????38????74??8B??8B??????????3B????0F85????????8B??????????8B??6A??5383????C7????????????89????508B??88??E8????????89????C7??????????????????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????C7????????????89????88????8B????64????????????595E5B8B??5DC3CCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????5356508D????64??????????33??89????538B??68????????8D????89????C7????????????89????88????E8????????C7????????????6A??8D????38????74??68????????EB??68????????E8????????8D????5083????8D????5651E8????????C6??????8D????52578B??E8????????83????C7????????????C6??????BE????????39????72??8B????50E8????????83????C7????????????89????88????88????39????72??8B????51E8????????83????C7????????????89????88????8B??8B????64????????????595E5B8B????33??E8????????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????F6??????C7????????????89????88????74??56E8????????83????8B??8B????64????????????595E5B8B??5DC2????CCCC558B??6A??68????????64??????????50A1????????33??508D????64??????????C7????????????6A??6A??8D????5083????E8????????C7????????????83??????72??8B????51E8????????83????C7????????????C7????????????C6??????8B????64????????????598B??5DC2????CCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????535657508D????64??????????33??89????8B????89????89????B8????????89????C7????????????89????88??89????8D????BF????????39????72??8B??8B????39????73??8D????8B????518D????518B??E8????????C6??????508B??E8????????C6??????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B??33??89????8B????89??????????89?????????? }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and pe.imphash ( ) == "548d9f5f1e74f34b85612667335d41f2" and all of them
}

Chaînes (1 motifs)

IdentifiantTypeValeurModificateurs
$patternhex{ 558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????89??????????C7????????????8D????C7??????????33??6A??89?????? …

Condition

uint16( 0 ) == 0x5a4d and filesize < 2000KB and pe.imphash ( ) == "548d9f5f1e74f34b85612667335d41f2" and all of them

En clair (Heuristique)

  • Le fichier doit commencer par « MZ » — un exécutable Windows (PE).
  • Le fichier doit faire moins de 2000KB (garde-fou peu coûteux qui écarte les gros fichiers).
  • Tous les motifs de la règle doivent être trouvés.
  • Utilise le module pe.
  • Vérifie le hash des imports PE (imphash).

Tester cette règle dans votre navigateur

Déposez un fichier pour le scanner avec cette règle grâce à YARA-X compilé en WebAssembly. Rien n’est envoyé.

Déposez un fichier ici ou cliquez pour choisirScanné localement avec YARA-X. Fichiers jusqu’à 200 Mo.

Ouvrir dans l’éditeur

Références

Hashes d’échantillons

Hashes des échantillons listés par l’auteur dans les métadonnées de la règle (à rechercher dans votre plateforme de threat intelligence).

  • 86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9

Licence et attribution

Auteur : Marc Rivero | McAfee ATR Team

Dépôt source : Trellix Advanced Research Center @ 1919562a59

Licence : Apache License 2.0 (licence du dépôt)

Règle d’origine

Reprise via YARA Forge 20260927, qui préfixe les noms de règles par la source et ajoute des champs meta normalisés.

Identifiant de règle: acc56237-a93a-55c0-a90c-11ca1da683db

Métadonnées

rule_versionv1
malware_typetrojan
malware_familyTrojan:W32/Milum
actor_typeApt
actor_groupUnknown

Tags:TROJANFILE

Règles liées

Plus de règles Milum