apt_muddywater_manifestation_backdoor_obfuscated

YARA detection rule by Sekoia.io · GPL-2.0

Detects obfuscated Muddys manifestation JScript backdoor

rule apt_muddywater_manifestation_backdoor_obfuscated {
  meta:
    id             = "58df72a1-822c-4b82-904d-1c0124dc7bc1"
    version        = "1.0"
    description    = "Detects obfuscated Muddys manifestation JScript backdoor"
    author         = "Sekoia.io"
    creation_date  = "2022-01-13"
    classification = "TLP:CLEAR"

  strings:
    $m = { 76 61 72 20 5f 30 78 [4-6] 3d 5b }
    $w = { 57 53 63 72 69 70 74 5b 5f 30 78 [4-6] 28 30 78 [2-3] 29 5d 28 30 78 [2-3] 2a 30 78 [2-3] 29 2c }
    $t = "subkeys(key));}"

  condition:
    $m at 0 and ($t at (filesize - 16) or $w in (filesize - 200..filesize))
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8f70caac-b42f-4039-8e25-3f6232147ac7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion