TRELLIX_ARC_Hermeticwiper

YARA detection rule by cb @ Trellix ATR · GPL-2.0

Detecting variants of Hermetic Wiper malware discovered in UA

rule TRELLIX_ARC_Hermeticwiper: TROJAN FILE {
  meta:
    description  = "Detecting variants of Hermetic Wiper malware discovered in UA"
    author       = " cb @ Trellix ATR"
    id           = "fc6d9238-b732-541d-b083-11b43fe8770d"
    date         = "2022-02-24"
    modified     = "2022-02-24"
    reference    = "https://github.com/advanced-threat-research/Yara-Rules/"
    source_url   = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Troj_HermWiper.yar#L1-L27"
    license_url  = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
    logic_hash   = "b48e91afa19e09c7035ccda1b9293448e834d612b9a953b593f9412acb78faac"
    score        = 75
    quality      = 70
    tags         = "TROJAN, FILE"
    rule_version = "v1"
    malware_type = "Trojan"

  strings:
    $0  = { E4 B5 51 8C D9 41 31 0A 01 5E 4A F8 E5 96 8C 82 31 49 2F E1 92 46 A2 93 A5 69 D5 D7 A3 6F 56 EB 2F C5 B6 8F FF 6F 33 59 C1 9A F6 80 69 20 C3 FE 66 28 F9 0A 75 44 0E 66 16 29 7A 03 1B A6 07 51 00 D7 2D FA A9 82 9E 77 2E 45 D7 7B 89 F8 62 08 1E AF DB 19 B4 B2 DC EF 3F 27 3F F6 45 AC CE AA 4B 99 1F 98 37 39 73 C0 FB 25 82 9E 86 0D 9B C1 95 EF 1A 0A D9 21 94 56 AD 07 7D 42 86 8E E0 3E E0 0E 88 D0 4C 43 4B A9 7E 88 DF 99 27 3A 35 E2 C6 68 A1 C6 99 54 B4 76 23 90 AB DF BE 4C D4 AF }
    $1  = { 90 50 6F 1C 82 5F 7A E0 D8 60 5F 5C 62 7C A3 25 BF F1 99 AB 60 A6 3D E8 A9 0E 92 3F 4B 18 D7 FB 03 9E 1D EC 89 D5 73 AA B0 A1 4C 1D 4B A7 0E B4 44 75 3A 41 C0 30 82 A6 0C B4 DB 55 13 93 F2 C5 09 88 A3 18 1E 7F 31 D0 1B 5A AD 94 07 04 32 D9 8F 18 65 5A B8 A5 55 91 9F EF EA 9D E1 ED F1 }
    $2  = { D5 EE F6 13 36 01 5A 85 FF 04 ED 29 8A 6B DD 67 42 FF 15 3E 33 DA F9 B3 83 A5 FF DC E7 E6 4D 47 74 8D B5 FF 26 09 DF 9B D5 C6 67 35 FF 69 16 79 7B 2D 36 53 13 FF 14 61 EA EB 9D AE A7 54 FF 6D 4D 55 D1 95 6C C8 CB FF 75 C1 0C E7 4B F8 8C 8D FF 3B 55 3B 83 9D 42 60 9F FF 29 16 22 72 30 }
    $3  = { 6C 75 0D DC 93 21 24 50 0C E9 B5 AB 91 CE 10 1B E9 AD 34 82 20 E9 42 31 24 51 22 82 37 36 75 15 22 81 02 34 28 82 5C 51 77 0F E9 84 1F 85 33 75 12 53 82 F7 32 75 0A 5B 83 F6 0F EB 6A EE 22 82 64 74 62 22 82 69 74 5A EE 22 82 6F 74 52 22 82 75 74 4A EE 22 82 78 74 42 }
    $4  = { 19 A8 A0 63 FF AA AF 6C 1E 7F 78 A8 96 FF FA 5C 8F 30 BA 98 B6 9C FF 19 61 E1 07 BE B7 63 6A FF 9E A5 6A 4F C4 ED E3 F1 FF 29 52 35 AC D0 18 57 26 FF AD A6 B8 CB 54 B3 42 C9 FF 86 F5 85 24 DC 91 61 7B FF B4 38 8D BE 01 B6 CF 86 }
    $5  = { 50 C4 49 60 6B 20 18 4A 63 28 55 60 32 19 76 60 AA F9 50 78 61 60 9F 61 60 64 05 60 B4 54 61 60 C3 A1 94 05 60 70 C4 A0 9E C4 A0 1A 04 61 A4 C4 A0 83 1B 16 60 05 61 91 60 69 A2 91 60 70 61 C0 91 60 AA 1C B6 20 4A }
    $6  = { FF EB 19 D2 63 6B 8B 95 27 31 56 BB 63 E8 C7 84 70 D5 59 70 F4 7C F2 65 74 B4 6D E8 6E E0 84 70 45 90 CA 80 53 F1 53 20 25 8B BD 1A AC F1 8B 04 F2 E9 65 C6 60 5C B1 08 80 B7 E8 FC F5 3D F5 EB 06 21 63 5E FF }
    $7  = { 7E 31 12 6E 14 B8 FF 98 55 4F 6F CF B6 42 07 FF CF 8D 93 B2 57 36 09 C2 FF 99 E4 40 9F 73 BB 93 22 FF 1E 5E 38 0D C0 BB AB CA FF 4B 90 1E DF 61 BD 6A 68 FF EE 32 53 72 8C 77 69 AB FF 7B CD A9 39 C9 59 A2 82 }
    $8  = { 19 70 FF C6 F8 AA 7C 32 EE 69 3C FF 36 95 79 E5 35 5E F6 2C FF 68 2C EA F2 0B A3 EA 1C FF 1A AC 63 86 66 43 1B 20 FF 54 29 3D 1E 70 9C 23 1A FF CD 11 B5 55 99 F6 4C B9 FF 1E 5A 90 15 DC 86 7F }
    $9  = { 8D FF 93 B2 57 36 09 C2 99 E4 FF 40 9F 73 BB 93 22 1E 5E FF 38 0D C0 BB AB CA 4B 90 FF 1E DF 61 BD 6A 68 EE 32 FF 53 72 8C 77 69 AB 7B CD FF A9 39 C9 59 A2 82 D3 12 FF 5D D0 4F 03 70 CE 81 1F }
    $10 = { DF 55 19 06 4E 31 10 1C F3 DA 96 C1 5F F9 67 28 B7 08 F3 58 F5 17 59 E3 A2 2F FA 1C F1 BB 98 6A 20 38 D6 75 3E 6B F0 37 94 5B 84 69 AD F2 0B AB 71 E1 0F 3D E2 77 35 F6 40 70 4C 97 0D FE 86 72 }

  condition:
    uint16(0) == 0x5a4d and filesize < 200KB and all of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

36a3d564-f792-44ea-8230-245a29e00e63

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion