DLL_Mustang_Panda_March2024

YARA detection rule by Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell · Unknown

Rule DLL_Mustang_Panda_March2024 (No description metadata provided).

import "pe"
rule DLL_Mustang_Panda_March2024 {
    meta:
        Description = "Detects a malicious DLL used by Mustang Panda (aka TA416) in a New Year Themed Campaign"
        author = "Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell"
        Credits = "@smica83 for sharing the malware sample on Malware Bazaar"
        Reference = "https://cyble.com/blog/festive-facade-dissecting-multi-stage-malware-in-new-year-themed-lure/"
        Hash = "dd261a5db199b32414c33136aed44c3ebe2ae55f18991ae3dc341fc43a1ef7f4"
        date = "2024-03-10"
        yarahub_author_twitter = "@RustyNoob619"
        yarahub_reference_md5 = "7ea17ffb336a7d8b24d62ba78151d264"
        yarahub_uuid = "4212deb2-8075-4756-a881-c7bf1296bd37"
        yarahub_license = "CC0 1.0"
        yarahub_rule_matching_tlp = "TLP:WHITE"
        yarahub_rule_sharing_tlp = "TLP:WHITE"

    strings:
        $unrefdll = "mscoree.dll"
    condition:
        pe.number_of_signatures == 0
        and pe.imphash() == "ff98d730c7b4fbaa92b85279e37acb21"
        and for 3 export in pe.export_details:
        (export.name startswith "WMGet")
        and pe.exports("DMGetDesktopInfo")
        and pe.exports("NVAutoStart")
        and pe.exports("NVLoadDatabase")
        and pe.exports("PMEnum")
        and any of them

}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e4f7ae89-b81c-4f73-9ada-7af2daeb511c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion