CloudDuke

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CloudDuke (No description metadata provided).

import "hash"
rule CloudDuke {
  meta:
    Author    = "Intezer Analyze"
    Reference = "https://apt-ecosystem.com"

  strings:
    $block_0  = { 5? 8B ?? 81 E? ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 ?? 89 ?? ?? 5? 8B ?? ?? 5? 83 ?? ?? ?? 5? 0F 84 }
    $block_1  = { 6A ?? 68 ?? ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? 85 ?? 0F 84 }
    $block_2  = { 8B ?? ?? ?? ?? ?? 4? 83 ?? ?? ?? 8D ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 0F 85 }
    $block_3  = { 8B ?? ?? 03 ?? 33 ?? 0F B7 ?? ?? 83 ?? ?? 03 ?? 0F B7 ?? ?? 5? 89 ?? ?? 85 ?? 74 }
    $block_4  = { 6A ?? 68 ?? ?? ?? ?? 5? 5? C7 ?? ?? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 85 ?? 0F 84 }
    $block_5  = { FF 7? ?? FF 7? ?? 5? E8 ?? ?? ?? ?? 0F B7 ?? ?? 83 ?? ?? 89 ?? ?? 85 ?? 75 }
    $block_6  = { 8B ?? ?? ?? 2B ?? ?? ?? 33 ?? 4? 03 ?? ?? ?? 99 13 ?? ?? ?? 3B ?? 0F 82 }
    $block_7  = { 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 85 ?? 0F 45 ?? ?? ?? ?? ?? 89 }
    $block_8  = { 6A ?? 68 ?? ?? ?? ?? FF 7? ?? 5? FF 1? ?? ?? ?? ?? 8B ?? 85 ?? 0F 84 }
    $block_9  = { 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? B9 ?? ?? ?? ?? 89 ?? ?? 66 ?? ?? ?? 74 }
    $block_10 = { 5? 8B ?? 83 ?? ?? 5? 5? 8B ?? 8B ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
    $block_11 = { 8D ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? ?? 85 ?? 0F 84 }
    $block_12 = { 0F B7 ?? ?? C1 ?? ?? 83 ?? ?? 89 ?? ?? 83 ?? ?? ?? ?? ?? ?? 74 }
    $block_13 = { C7 ?? ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? 89 ?? ?? 85 ?? 0F 84 }
    $block_14 = { 8B ?? 33 ?? 89 ?? 4? 83 ?? ?? 83 ?? ?? 3B ?? ?? 0F 8C }
    $block_15 = { 8B ?? ?? 03 ?? 89 ?? ?? 81 3? ?? ?? ?? ?? 0F 85 }

  condition:
    hash.sha256(0, filesize) == "d4d79be85dc98f74088d6393a8fdf2b5d947ae4f279909af2aed0221dcecfe94" or
    hash.sha256(0, filesize) == "d3d503934c0dfe75e386d0fb8da2e32238d93739624b6c5a929fe5b722b35d36" or
    hash.sha256(0, filesize) == "6c8eb3365b7fb7683b9b465817e5cb87574026e306c700f3d103eba056777720" or
    hash.sha256(0, filesize) == "ecd0ce1973500c27bb5d70f326d115fba84c0b1680a726a041ed57b42063e7b1" or
    hash.sha256(0, filesize) == "0f7d64f514e99a2abdc10dc85e7e6f57c210a0f35472f7b897a19b73be36bece" or
    hash.sha256(0, filesize) == "12f58639a883b0fcfe3d2e8bcb0330b978731975c9dfa2f8e583adbafc4d534e" or
    hash.sha256(0, filesize) == "c1ee4232d1b6504fc7f93cb0478e90049a71992498ed2d701925d852e91cfcc3" or
    hash.sha256(0, filesize) == "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7" or
    hash.sha256(0, filesize) == "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f" or
    hash.sha256(0, filesize) == "c3ea57eea9f522cfc70ef8c3b614f7e44903293a2e8354359b99efbf4cd436df" or
    hash.sha256(0, filesize) == "85c5ba695992ed59269ea7f7a58f3453f6047729d1f68a444d450439bbccc1f4" or
    hash.sha256(0, filesize) == "6c7e768e48b9b225b7b9f84528c53c2e6f9b639ce2e7919fe0dff9aad07ea4f5" or
    hash.sha256(0, filesize) == "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145" or
    hash.sha256(0, filesize) == "bfc1bafd9b01178037226fa55546d7ed7e9203c13e1b66419e887fee704d5196" or
    hash.sha256(0, filesize) == "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46" or
    hash.sha256(0, filesize) == "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004" or
    hash.sha256(0, filesize) == "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7" or
    hash.sha256(0, filesize) == "e1490d6e5ce4c2cddef0815c55bf8946cb830ce0ac7f586cf1ae16ef66f1bd8b" or
    hash.sha256(0, filesize) == "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e" or
    12 of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

bc904644-b3da-44ff-8401-ae84596ba9e0

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion