[[ fm.text ]] Click here

apt_malware_win_lightspy_orchestrator_decoded_C2_strings

YARA detection rule by threatintel@volexity.com · See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt

Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc.

rule apt_malware_win_lightspy_orchestrator_decoded_C2_strings: BrazenBamboo
{
    meta:
        author = "threatintel@volexity.com"
        description = "Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc."
        date = "2024-02-15"
        hash1 = "80c0cdb1db961c76de7e4efb6aced8a52cd0e34178660ef34c128be5f0d587df"
        os = "win"
        os_arch = "all"
        scan_context = "file,memory"
        severity = "critical"
        last_modified = "2024-11-14T11:48:37Z"
        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
        rule_id = 10245
        version = 4

    strings:
        $s1 = "[WsClient][Error]:"
        $s2 = "[WsClient][Info]:"
        $s3 = "[WsClient]:WsClient"
        $s4 = "[WsClient][Info]:Ws"
        $s5 = "WsClient Worker Thread ID=%d"
        $s6 = "[LightWebClient]:"
        $s7 = "LightHttpGet err:%s"
        $s8 = "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.145 Safari/537.36"
        $s9 = "KvList Err:%s"
        $s10 = "dataMultiPart malloc err:%d"

        $ctrl1 = "CTRL_HEART_BEAT"
        $ctrl2 = "CTRL_NET_CONFIG"
        $ctrl3 = "CTRL_COMMAND_PLAN"
        $ctrl4 = "CTRL_MODIFY_NET_CONFIG"
        $ctrl5 = "CTRL_UPLOAD_PLUGIN_STATUS"
        $ctrl6 = "CTRL_PLUGIN_EXECUTE_COMMAND"
        $ctrl7 = "CTRL_PLUGIN_COMMAND_STATUS"
        $ctrl8 = "CTRL_PLUGIN_STOP_COMMAND"
        $ctrl9 = "CTRL_GET_SLEEP_CONFIG"
        $ctrl10 = "CTRL_MODIFY_SLEEP_CONFIG"
        $ctrl11 = "CTRL_SLEEP_STATUS"
        $ctrl12 = "CTRL_UPDATE_PLUGIN"
        $ctrl13 = "CTRL_DESTROY"
        $ctrl14 = "CTRL_RECONFIG_REBOUNT_ADDRESS"
        $ctrl15 = "CTRL_AUTO_UPLOUD_FILE_CONFIG"
        $ctrl16 = "CTRL_UPLOUD_DEVICE_INFO"
        $ctrl17 = "CTRL_TEST_VPDN_ACCOUNT"

     condition:
        3 of ($s*)
        or 5 of ($ctrl*)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c45e6b60-d495-41a7-98dc-0f23dfc18a62

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion