Skip to content

Commit 626b48d

Browse files
octo-sts[bot]github-actions[bot]
octo-sts[bot]
and
github-actions[bot]
authored
Update third-party rules as of 2025-11-23 (#1229)
Co-authored-by: Update third-party rules <41898282+github-actions[bot]@users.noreply.github.com>
1 parent f37f758 commit 626b48d

File tree

105 files changed

+231
-231
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

105 files changed

+231
-231
lines changed

‎third_party/yara/bartblaze/APT/Confucius_B.yar‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ rule Confucius_B
88
first_imported = "2021-12-30"
99
last_modified = "2021-12-30"
1010
status = "RELEASED"
11-
sharing = "TLP:WHITE"
11+
sharing = "TLP:CLEAR"
1212
source = "BARTBLAZE"
1313
author = "@bartblaze"
1414
description = "Identifies Confucius malware."

‎third_party/yara/bartblaze/APT/Cotx_RAT.yar‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ rule Cotx_RAT
1010
first_imported = "2021-12-30"
1111
last_modified = "2021-12-30"
1212
status = "RELEASED"
13-
sharing = "TLP:WHITE"
13+
sharing = "TLP:CLEAR"
1414
source = "BARTBLAZE"
1515
author = "@bartblaze"
1616
description = "Identifies Cotx RAT."

‎third_party/yara/bartblaze/APT/EE_Dropper.yar‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ rule EE_Dropper
88
date = "2025-10-27"
99
modified = "2025-10-27"
1010
status = "RELEASED"
11-
sharing = "TLP:WHITE"
11+
sharing = "TLP:CLEAR"
1212
source = "BARTBLAZE"
1313
author = "@bartblaze"
1414
description = "Identifies dropper, EXE dropping and loading 3 CAB files, as seen in Earth Estries campaign."

‎third_party/yara/bartblaze/APT/EE_Loader.yar‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ rule EE_Loader
77
date = "2025-10-27"
88
modified = "2025-10-27"
99
status = "RELEASED"
10-
sharing = "TLP:WHITE"
10+
sharing = "TLP:CLEAR"
1111
source = "BARTBLAZE"
1212
author = "@bartblaze"
1313
description = "Identifies loader used by Earth Estries."

‎third_party/yara/bartblaze/APT/NikiCert.yar‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,26 @@
1-
import "pe"
2-
rule NikiCert
3-
{
4-
meta:
5-
id = "64lhugyfG9DlAydhTGBb4F"
6-
fingerprint = "v1_sha256_d346c46bb51beaefcfdc247e20af3ceda6d239366c7126e1a568036ef4c8f60f"
7-
version = "1.0"
8-
creation_date = "2024-06"
9-
status = "RELEASED"
10-
sharing = "TLP:WHITE"
11-
source = "BARTBLAZE"
12-
author = "@bartblaze, @nsquar3"
13-
description = "Identifies Nexaweb digital certificate used in (likely) Kimsuky campaign."
14-
category = "MALWARE"
15-
malware = "NIKIHTTP"
16-
malware_type = "BACKDOOR"
17-
reference = "https://cyberarmor.tech/new-north-korean-based-backdoor-packs-a-punch/"
18-
hash = "cca1705d7a85fe45dce9faec5790d498427b3fa8e546d7d7b57f18a925fdfa5d"
19-
hash = "000e2926f6e094d01c64ff972e958cd38590299e9128a766868088aa273599c7"
20-
21-
condition:
22-
uint16(0) == 0x5A4D and
23-
for any i in (0 .. pe.number_of_signatures) : (
24-
pe.signatures[i].serial == "03:15:e1:37:a6:e2:d6:58:f0:7a:f4:54:c6:3a:0a:f2"
25-
)
26-
}
1+
import "pe"
2+
rule NikiCert
3+
{
4+
meta:
5+
id = "64lhugyfG9DlAydhTGBb4F"
6+
fingerprint = "v1_sha256_d346c46bb51beaefcfdc247e20af3ceda6d239366c7126e1a568036ef4c8f60f"
7+
version = "1.0"
8+
creation_date = "2024-06"
9+
status = "RELEASED"
10+
sharing = "TLP:CLEAR"
11+
source = "BARTBLAZE"
12+
author = "@bartblaze, @nsquar3"
13+
description = "Identifies Nexaweb digital certificate used in (likely) Kimsuky campaign."
14+
category = "MALWARE"
15+
malware = "NIKIHTTP"
16+
malware_type = "BACKDOOR"
17+
reference = "https://cyberarmor.tech/new-north-korean-based-backdoor-packs-a-punch/"
18+
hash = "cca1705d7a85fe45dce9faec5790d498427b3fa8e546d7d7b57f18a925fdfa5d"
19+
hash = "000e2926f6e094d01c64ff972e958cd38590299e9128a766868088aa273599c7"
20+
21+
condition:
22+
uint16(0) == 0x5A4D and
23+
for any i in (0 .. pe.number_of_signatures) : (
24+
pe.signatures[i].serial == "03:15:e1:37:a6:e2:d6:58:f0:7a:f4:54:c6:3a:0a:f2"
25+
)
26+
}

‎third_party/yara/bartblaze/APT/NikiGo.yar‎

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,36 @@
1-
rule NikiGo
2-
{
3-
meta:
4-
id = "1TfLvwe4Pw7svDq8aY4v5F"
5-
fingerprint = "v1_sha256_8ba5e84e750a707eacabbf1df13900ef96ef773745f0f623f41da5e7ca905420"
6-
version = "1.0"
7-
date = "2024-06"
8-
status = "RELEASED"
9-
sharing = "TLP:WHITE"
10-
source = "BARTBLAZE"
11-
author = "@bartblaze, @nsquar3"
12-
description = "Identifies NikiGo, a Go dropper by (likely) Kimsuky."
13-
category = "MALWARE"
14-
malware = "NIKIHTTP"
15-
malware_type = "BACKDOOR"
16-
reference = "https://cyberarmor.tech/new-north-korean-based-backdoor-packs-a-punch/"
17-
hash = "000e2926f6e094d01c64ff972e958cd38590299e9128a766868088aa273599c7"
18-
19-
strings:
20-
$go = "Go build ID:"
21-
22-
$func1 = "main.ParseCommandLine" ascii wide fullword
23-
$func2 = "main.RunCmd" ascii wide fullword
24-
$func3 = "main.HttpGet" ascii wide fullword
25-
$func4 = "main.SelfDel" ascii wide fullword
26-
$func5 = "main.RandomBytes" ascii wide fullword
27-
28-
$pdb_src = "C:/Users/niki/go/src/niki/auxiliary/engine-binder/main.go" ascii wide
29-
$pdb_path = "/Users/niki/go/src/niki/auxiliary/engine-binder/" ascii wide
30-
31-
condition:
32-
uint16(0) == 0x5A4D and $go and (
33-
all of ($func*) or
34-
any of ($pdb*)
35-
)
36-
}
1+
rule NikiGo
2+
{
3+
meta:
4+
id = "1TfLvwe4Pw7svDq8aY4v5F"
5+
fingerprint = "v1_sha256_8ba5e84e750a707eacabbf1df13900ef96ef773745f0f623f41da5e7ca905420"
6+
version = "1.0"
7+
date = "2024-06"
8+
status = "RELEASED"
9+
sharing = "TLP:CLEAR"
10+
source = "BARTBLAZE"
11+
author = "@bartblaze, @nsquar3"
12+
description = "Identifies NikiGo, a Go dropper by (likely) Kimsuky."
13+
category = "MALWARE"
14+
malware = "NIKIHTTP"
15+
malware_type = "BACKDOOR"
16+
reference = "https://cyberarmor.tech/new-north-korean-based-backdoor-packs-a-punch/"
17+
hash = "000e2926f6e094d01c64ff972e958cd38590299e9128a766868088aa273599c7"
18+
19+
strings:
20+
$go = "Go build ID:"
21+
22+
$func1 = "main.ParseCommandLine" ascii wide fullword
23+
$func2 = "main.RunCmd" ascii wide fullword
24+
$func3 = "main.HttpGet" ascii wide fullword
25+
$func4 = "main.SelfDel" ascii wide fullword
26+
$func5 = "main.RandomBytes" ascii wide fullword
27+
28+
$pdb_src = "C:/Users/niki/go/src/niki/auxiliary/engine-binder/main.go" ascii wide
29+
$pdb_path = "/Users/niki/go/src/niki/auxiliary/engine-binder/" ascii wide
30+
31+
condition:
32+
uint16(0) == 0x5A4D and $go and (
33+
all of ($func*) or
34+
any of ($pdb*)
35+
)
36+
}

‎third_party/yara/bartblaze/APT/NikiHTTP.yar‎

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,37 @@
1-
rule NikiHTTP
2-
{
3-
meta:
4-
id = "7Hna0G06TFoi4ogjbgXnvV"
5-
fingerprint = "v1_sha256_0315e58657b36871b5937d06b338363de94e6bb81c19d03b92a53e2b525f56b4"
6-
version = "1.0"
7-
date = "2024-06"
8-
status = "RELEASED"
9-
sharing = "TLP:WHITE"
10-
source = "BARTBLAZE"
11-
author = "@bartblaze, @nsquar3"
12-
description = "Identifies NikiHTTP aka HTTPSpy, a versatile backdoor by (likely) Kimsuky."
13-
category = "MALWARE"
14-
malware = "NIKIHTTP"
15-
malware_type = "BACKDOOR"
16-
reference = "https://cyberarmor.tech/new-north-korean-based-backdoor-packs-a-punch/"
17-
hash = "3314b6ea393e180c20db52448ab6980343bc3ed623f7af91df60189fec637744"
18-
hash = "c94a5817fcd6a4ea93d47d70b9f2b175923a8b325234a77f127c945ae8649874"
19-
20-
strings:
21-
$cmd = {4? 8d 0d be 2f 03 00 4? 85 c0 4? 8d 15 8c 2f 03 00}
22-
$str_1 = "%s%sc %s >%s 2>&1" ascii wide
23-
$str_2 = "%s%sc %s 2>%s" ascii wide
24-
$str_3 = "%s:info" ascii wide
25-
26-
//D:\02.data\03.atk-tools\engine\niki\httpSpy\..\bin\httpSpy.pdb
27-
$pdb_full = "\\02.data\\03.atk-tools\\"
28-
$pdb_httpspy = "\\bin\\httpSpy.pdb"
29-
30-
$code = {0f 57 c0 4? 89 7? ?? 33 c0 c7 4? ?? 68 00 00 00 0f 11 4? ?? c7 4? ?? 01 00 00 00 66 4? 89 7? 00 0f 11 4? ?? 4? 89 4? ?? 0f 11 4? ?? c7 44 ?? ?? 53 71 80 60 0f 11 4? ?? c7 44 ?? ?? 71 79 7c 5c 0f 11 4? ?? c7 44 ?? ?? 6d 80 74 63 0f 11 4? ?? 88 44 ?? ?? 0f 11 4? ?? 0f 1f 44 00 00}
31-
32-
condition:
33-
uint16(0) == 0x5A4D and (
34-
$cmd or (2 of ($str_*)) or
35-
any of ($pdb_*) or $code
36-
)
37-
}
1+
rule NikiHTTP
2+
{
3+
meta:
4+
id = "7Hna0G06TFoi4ogjbgXnvV"
5+
fingerprint = "v1_sha256_0315e58657b36871b5937d06b338363de94e6bb81c19d03b92a53e2b525f56b4"
6+
version = "1.0"
7+
date = "2024-06"
8+
status = "RELEASED"
9+
sharing = "TLP:CLEAR"
10+
source = "BARTBLAZE"
11+
author = "@bartblaze, @nsquar3"
12+
description = "Identifies NikiHTTP aka HTTPSpy, a versatile backdoor by (likely) Kimsuky."
13+
category = "MALWARE"
14+
malware = "NIKIHTTP"
15+
malware_type = "BACKDOOR"
16+
reference = "https://cyberarmor.tech/new-north-korean-based-backdoor-packs-a-punch/"
17+
hash = "3314b6ea393e180c20db52448ab6980343bc3ed623f7af91df60189fec637744"
18+
hash = "c94a5817fcd6a4ea93d47d70b9f2b175923a8b325234a77f127c945ae8649874"
19+
20+
strings:
21+
$cmd = {4? 8d 0d be 2f 03 00 4? 85 c0 4? 8d 15 8c 2f 03 00}
22+
$str_1 = "%s%sc %s >%s 2>&1" ascii wide
23+
$str_2 = "%s%sc %s 2>%s" ascii wide
24+
$str_3 = "%s:info" ascii wide
25+
26+
//D:\02.data\03.atk-tools\engine\niki\httpSpy\..\bin\httpSpy.pdb
27+
$pdb_full = "\\02.data\\03.atk-tools\\"
28+
$pdb_httpspy = "\\bin\\httpSpy.pdb"
29+
30+
$code = {0f 57 c0 4? 89 7? ?? 33 c0 c7 4? ?? 68 00 00 00 0f 11 4? ?? c7 4? ?? 01 00 00 00 66 4? 89 7? 00 0f 11 4? ?? 4? 89 4? ?? 0f 11 4? ?? c7 44 ?? ?? 53 71 80 60 0f 11 4? ?? c7 44 ?? ?? 71 79 7c 5c 0f 11 4? ?? c7 44 ?? ?? 6d 80 74 63 0f 11 4? ?? 88 44 ?? ?? 0f 11 4? ?? 0f 1f 44 00 00}
31+
32+
condition:
33+
uint16(0) == 0x5A4D and (
34+
$cmd or (2 of ($str_*)) or
35+
any of ($pdb_*) or $code
36+
)
37+
}

‎third_party/yara/bartblaze/APT/RokRAT.yar‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ meta:
66
version = "1.0"
77
modified = "2024-03-08"
88
status = "RELEASED"
9-
sharing = "TLP:WHITE"
9+
sharing = "TLP:CLEAR"
1010
source = "BARTBLAZE"
1111
author = "@bartblaze"
1212
description = "Identifies RokRAT."

‎third_party/yara/bartblaze/APT/RoyalRoad_RTF.yar‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ rule RoyalRoad_RTF
88
first_imported = "2021-12-30"
99
last_modified = "2025-03-10"
1010
status = "RELEASED"
11-
sharing = "TLP:WHITE"
11+
sharing = "TLP:CLEAR"
1212
source = "BARTBLAZE"
1313
author = "@bartblaze"
1414
description = "Identifies RoyalRoad RTF, used by multiple China-based APT groups."

‎third_party/yara/bartblaze/APT/StormDNS.yar‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ rule StormDNS
77
date = "2025-07-24"
88
modified = "2025-07-24"
99
status = "RELEASED"
10-
sharing = "TLP:WHITE"
10+
sharing = "TLP:CLEAR"
1111
source = "BARTBLAZE"
1212
author = "@bartblaze"
1313
description = "Identifies StormDNS, a DNS shell used by Storm-260 to receive and execute commands from a C2."

0 commit comments

Comments
 (0)