APT_winnti

YARA detection rule by McAfee ATR Team · Apache-2.0

Detects Winnti variants

rule APT_winnti {

	meta:
		description = "Detects Winnti variants"
		author = "McAfee ATR Team"
		date = "2020-06-04"
		rule_version = "v1"
      	        malware_type = "backdoor"
      	        malware_family = "Backdoor:W32/Winnti"
      	        actor_type = "Apt"
          	actor_group = "Unknown"
		reference = "https://attack.mitre.org/software/S0141/"
		hash = "fd539d345821d9ac9b885811b1f642aa1817ba8501d47bc1de575f5bef2fbf9e"

	strings:
		

    	$pattern = { 9090909090909090909090909090C7????????????C2????90909090909081??????????E9????????CCCCCCCCCC8A??????8B??????538A??8A??568B??578B??????8B??C1????66????8B??C1????F3AB8B??83????F3AA8B??5F5E5BC390909090909090909090909090909083????5333??568D??????535089??????89??????E8????????8A??33??3A??8D??????0F94??83????5389??????528B??89??????C6????????E8????????8B??33??81??????????8D??????0F94??6A??89??????5223??89??????C6????????C6????????E8????????33??66????8D??????6A??0F94??89??????89??????5223??C6????????C6????????E8????????8B??83????33??3B??0F94??23??5E495BF7??1B??8B??83????C38B??????8B??????03??C390909090908B??????85??0F84????????8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??E9????????83????C39090909090909090909090909083????8B??????53558B??????33??568B??????83????5789??????76??81??????????8B??76??BF????????8B??????8D????03??C1????03??89??????3B??76??8B??????68????????6A??52E8????????8B??????8B??????8B??????505351565752E8????????8B??????8B??8B??????2B??8B??83????03??8B??????83????89??????77??03??0F84????????8B??????8B??????2B??03??3B??89??????75??81??????????77??8A??04??EB??83????77??08????EB??83????77??8A??80????88??EB??8D????C6????463D????????89??????76??8D????B8????????F7??C1????8B??33??8B??8B??C1????F3AB8B??83????03??F3AA8B??????81??????????4A89??????75??8B??????8B??88??468A??88??46424B75??8B??????C6????465FC6????46C6????2B??8B??????4633??89??5E5D5B83????C390909090909090909083????8B??????53558B??????568B??????8D????5789??????8B??????83????73??B8????????2B??EB??33??03??8B??2B??C1????8D??????89??????8B??????8B??????8D????3B??0F83????????8B??8B??69??????????8B??????8B??????C1????33??66??????03??8B??????2B??????89??????66??????8B??3B??0F85????????8B??????C7??????????????2B??8B??????8B??2B??0F84????????83????77??8A????0A??88????8B????89??03??E9????????83????77??8A??2C??88??468B????89??8B????89????8B????89????8B????89????03??E9????????83????77??8A??80????88??46EB??8D????C6????463D????????89??????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??8B??????81??????????4889??????75??8B??????8B??8B??????88??468B????89??8B????89????8B????89????8B????89????83????83????83????83????73??85??76??8A????88??46454B75??BB????????8B????8B????33??75??BB????????03??8B????8B??33??8B??????83????3B??73??8B??2B??????85??75??83????83????8B????8B??33??8B??????3B??72??EB??84??75??C1????4384??74??8B??????8B??03??2B??83????89??????77??3D????????77??4880????8A??80????C0????C0????0A??88??46C1????88??46E9????????3D????????77??4883????89??????77??80????80????EB??83????C6????4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????2D????????83????89??????77??8B??80????C1????80????8A??0A??80????88??46C0????88??46C1????88??46E9????????8B??83????C1????80????80????88??4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????8B??????E9????????8B??????8B??????8B??????2B??89??8B??5F2B??5E5D03??5B83????C390909090909090909090908B??????538B??????55568B??????C7??????????578A??8D????8B??????80????8B??76??81??????????8D????83????8B??83????0F82????????8A??88??40414F75??EB??33??8A??418B??83????0F83????????85??75??80????75??8A????81??????????4184??74??33??8A??418D??????8B??89??83????83????4E74??83????72??8B??89??83????83????83????83????73??85??76??8A??88??40414E75??EB??8A??88??40414E75??33??8A??418B??83????73??33??8B??8A??C1????2B??C1????2B??8A??????????81??????????4188??40478A??88??8A????4088??408A????83????8B??0F84????????8A??88??404183????76??8A??88??404183????76??8A??88??404133??8A??418B??83????72??8B??8B??C1????83????2B??33??8A??C1????2B??4F41C1????4E8A??88??8A????404788??40478A??88??40474E75??EB??83????72??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????8D????66????81??????????C1????2B??83????EB??83????0F82????????8B??8B??83????C1????2B??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????66????81??????????C1????2B??83????3B??74??81??????????83????0F82????????8B??2B??83????0F8C????????8B??89??83????83????83????8B??89??83????83????83????83????73??85??0F86????????8A??88??40474E75??E9????????33??8B??8A??C1????2B??C1????2B??4F41E9????????8B??????2B??3B??89??75??5F5E5D33??5BC31B??5F24??5E5D83????5BC39090909090909090909090909081??????????568B??68????????C7??????????FF??????????83????75??57B9????????33??8D??????66????????????F3AB66AB8D??????5068????????FF??????????83????5F75??6A??68????????FF??????????8B??5E81??????????C390909090909090909090909090568B??E8????????F6????????74??56E8????????83????8B??5EC2????909068????????C7??????????FF??????????85??75??FF??????????C39090909053558B??????5685??5774??8B??????85??74??33??33??33??85??76??8A??????????8A??????????32??80????32??8A????32??33??88????8D????BE????????F7??8D????BF????????8B??33??F7??413B??8B??72??5F5E5D5BC39083????538B??????55565768????????68????????5333??FF??????????8B??85??0F84????????68????????FF??????????8B??B0??88??????88??????8D??????B1??5056C6????????88??????C6????????C6????????C6????????C6????????88??????C6????????C6????????C6????????C6????????FF??????????5753FF??568B??FF??????????85??74??57FF??????????8B??8B??????B9????????8B??68????????50F3A5E8????????83????B8????????5F5E5D5B83????C35F8B??5E5D5B83????C39090538B??????????5657C7??????????8D????BF???????? }

        condition:
             uint16(0) == 0x5a4d and
             filesize < 400KB and
             all of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2e72edfe-3fc1-4fa5-9112-9ab72b91cde3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion