ARKBIRD_SOLG_EXF_Exmatter_Nov_2021_1

YARA detection rule by Arkbird_SOLG · GPL-2.0

Detect packed Exmatter with Confuser

rule ARKBIRD_SOLG_EXF_Exmatter_Nov_2021_1: FILE {
  meta:
    description = "Detect packed Exmatter with Confuser"
    author      = "Arkbird_SOLG"
    id          = "ddae7776-3202-50e6-b8af-0e5d15373386"
    date        = "2021-11-01"
    modified    = "2021-11-01"
    reference   = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration"
    source_url  = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Exmatter/EXF_Exmatter_Nov_2021_1.yara#L1-L22"
    license_url = "N/A"
    logic_hash  = "67aaac3db488a9e28897047a7498b7a447ec63cdb6da82cb3d4217c7d615f176"
    score       = 50
    quality     = 75
    tags        = "FILE"
    hash1       = "b6bc126526e27c98a94aab16989864161db1b3a75f18bd5c72bacbdfccad7bd7"
    hash2       = "8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef"
    hash3       = "325ecd90ce19dd8d184ffe7dfb01b0dd02a77e9eabcb587f3738bcfbd3f832a1"
    level       = "Experimental"
    tlp         = "white"
    adversary   = "RaaS"

  strings:
    $s1 = { 45 38 42 44 32 35 45 33 46 35 33 34 39 39 41 43 31 39 42 44 42 34 31 45 37 36 45 38 36 38 39 37 38 39 31 31 42 43 35 41 44 46 37 36 34 33 31 38 33 45 34 38 36 33 38 32 42 44 33 42 42 44 30 30 00 35 41 41 34 30 37 35 37 33 42 34 43 36 45 43 43 41 45 35 36 44 30 46 35 43 34 33 35 34 36 32 33 39 38 43 30 41 46 42 35 33 46 36 44 36 32 33 31 44 38 39 34 44 34 44 31 41 37 46 44 36 45 30 30 00 42 33 39 46 43 34 39 41 36 31 35 36 45 37 31 35 45 38 42 39 37 41 35 30 46 44 34 35 46 45 34 36 38 37 30 37 38 44 42 44 31 45 45 43 46 46 44 39 46 38 35 31 34 30 42 35 33 31 36 45 39 32 31 30 00 44 33 30 39 45 32 43 32 30 31 43 37 35 43 43 30 38 43 35 33 36 42 41 34 30 32 31 45 41 35 37 43 45 42 34 44 30 34 34 39 32 36 30 31 36 46 46 39 39 46 45 44 45 36 31 35 34 36 31 30 41 32 31 30 00 36 43 37 35 38 36 33 43 32 46 39 38 44 37 46 41 45 33 36 45 37 44 46 43 45 38 46 31 39 45 43 39 35 41 46 30 30 43 43 42 33 44 43 39 39 39 31 38 46 42 38 43 30 42 35 38 39 42 30 42 34 35 31 30 }
    $s2 = { 33 44 33 32 31 41 45 42 34 33 39 35 36 30 34 38 46 35 43 37 35 41 38 42 38 36 36 35 32 34 33 34 44 31 33 31 30 31 31 32 45 37 44 36 42 37 38 46 42 37 35 44 39 33 35 36 31 44 31 31 30 39 38 31 00 34 39 44 38 32 36 38 33 30 42 35 44 39 32 30 34 34 38 46 37 34 42 42 42 45 44 42 33 36 31 46 31 37 43 39 44 44 34 36 31 45 30 44 43 33 44 45 44 31 31 34 45 36 45 31 33 45 30 31 37 33 39 38 31 00 31 45 42 30 38 30 36 38 33 30 39 37 41 32 37 46 42 37 34 33 46 36 32 44 30 38 33 38 44 34 42 41 36 34 33 35 46 44 43 33 38 38 32 41 36 41 36 37 45 46 42 43 32 32 34 45 37 31 42 44 42 43 38 31 00 46 39 45 39 31 44 44 39 44 32 36 32 38 43 43 32 39 32 42 41 43 32 36 35 39 41 35 35 34 34 42 38 42 46 42 30 41 44 31 46 38 31 30 30 43 37 35 45 38 32 44 44 33 42 32 43 45 44 30 35 43 37 39 31 00 45 44 44 31 45 32 34 31 37 36 33 46 34 33 33 35 30 38 37 42 39 38 41 44 30 37 35 38 44 36 39 33 31 39 32 42 37 37 45 44 37 32 41 39 36 43 38 42 33 35 41 45 31 39 34 41 45 38 45 39 31 41 39 31 00 38 43 46 31 34 42 43 33 42 46 39 44 36 31 30 30 43 41 38 41 }
    $s3 = "SSH_MSG_NEWKEYS" ascii
    $s4 = { 35 45 46 32 31 35 39 31 38 33 32 30 41 44 38 41 46 41 41 30 32 35 33 35 35 34 36 46 34 34 33 43 38 44 30 39 46 30 41 44 35 31 33 37 45 35 32 30 33 34 32 38 38 43 37 36 39 41 43 36 42 41 44 46 00 44 36 32 45 45 38 34 39 37 41 45 34 39 35 41 33 31 31 34 35 41 37 37 41 35 43 39 44 35 35 37 30 34 43 30 38 38 33 42 30 31 35 46 45 31 41 45 39 46 44 46 46 45 32 30 38 46 31 33 46 41 45 44 46 00 31 35 32 30 33 33 46 38 33 46 37 46 41 36 36 34 35 31 39 33 42 33 32 32 43 43 42 31 36 37 32 46 30 38 39 35 36 42 36 38 43 33 38 44 31 33 32 46 32 32 37 38 46 43 46 30 46 41 30 34 44 46 45 46 00 33 41 33 36 41 46 34 41 46 30 41 31 46 45 35 37 39 35 44 42 39 39 46 41 38 44 33 39 34 46 41 32 44 38 39 30 41 32 32 35 32 38 30 41 38 41 31 35 39 41 43 37 39 46 31 45 34 38 45 45 31 38 46 46 00 44 43 37 42 45 38 33 42 33 45 46 46 38 31 45 38 43 39 45 30 36 46 37 44 37 43 31 46 34 42 44 37 33 34 46 32 30 32 30 41 34 32 34 32 39 45 32 32 41 32 36 31 42 30 45 45 45 31 36 44 31 39 46 46 }
    $s5 = { 39 38 41 43 30 38 30 44 38 38 37 45 31 34 43 43 39 32 32 44 34 35 37 43 33 42 31 30 35 35 37 31 45 33 36 41 37 35 43 43 39 31 31 42 33 35 46 36 30 43 32 46 35 30 36 44 44 44 45 43 35 43 41 46 00 31 33 46 33 37 31 33 43 30 38 42 33 30 43 45 34 37 36 35 37 33 45 43 31 38 32 39 30 31 32 35 30 45 39 36 42 34 37 37 35 33 31 39 46 34 36 41 38 41 30 30 41 34 46 31 45 42 38 41 43 35 32 42 46 00 43 39 38 39 33 42 41 33 46 43 31 46 41 39 41 37 43 38 37 33 42 32 37 38 37 41 41 41 44 38 38 39 45 33 38 46 30 43 33 39 36 39 45 37 41 32 37 42 30 44 33 37 45 30 41 }
    $s6 = "SSH_MSG_KEX_DH_GEX_INIT" ascii

  condition:
    uint16(0) == 0x5a4d and filesize > 600KB and 5 of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

061a215e-e228-475e-82c5-320e80f88b28

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion