case_19438_files_MalFiles_2326

YARA detection rule by The DFIR Report · GPL-2.0

19438 - file 2326.js

rule case_19438_files_MalFiles_2326 {
  meta:
    description = "19438 - file 2326.js"
    author      = "The DFIR Report"
    reference   = "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise"
    date        = "2023-10-29"
    hash1       = "b1f52abc28427c5a42a70db9a77163dde648348e715f59e8a335c7252ae4a032"

  strings:
    $x1  = "var YLJajsi = '>2F>2' + E6(-0x73, -0x8f, -0x7b, -0x63, -0x70, -0xb1, -0x71) + E7(0x275, 0x2b6, 0x29b, 0x274, 0x261, 0x283, 0x26d" ascii
    $s2  = "20d) + '0AYZqOsTxnMmpABJCF>2EShellExecute>28>22cmd>22>2C>20>' + E8(0x12b, 0x169, 0x133, 0x125, 0x11b, 0x172, 0x143) + EA(-0x5a, " ascii
    $s3  = "x145, 0x182, 0x157, 0x13a, 0x12e, 0x142) + 'D' + 'nop>20>2Dw>20hidden>20>22>2B>20>2F>2FIxqOgMKi>0D>0A>22>2Dep>20bypaSS>20>2DenC>" ascii
    $s4  = "19b, -0x19e, -0x1c9, -0x172, -0x181, -0x1b9)) / 0x6) + -parseInt(n(-0x103, -0xfd, -0x105, -0xd2, -0xe0, -0xf8, -0xe5)) / 0x7 + -" ascii
    $s5  = "var YLJajsi = '>2F>2' + E6(-0x73, -0x8f, -0x7b, -0x63, -0x70, -0xb1, -0x71) + E7(0x275, 0x2b6, 0x29b, 0x274, 0x261, 0x283, 0x26d" ascii
    $s6  = "0x342, -0x31d)) / 0x9) + -parseInt(f(-0xee, -0x10f, -0xe4, -0x12f, -0xff, -0x124, -0x126)) / 0xa;" fullword ascii
    $s7  = "parseInt(n(-0x121, -0x134, -0x12f, -0x118, -0xf8, -0x144, -0x10d)) / 0x8 * (parseInt(c(-0x31d, -0x32d, -0x346, -0x372, -0x35b, -" ascii
    $s8  = " 0x73)) / 0x2 * (parseInt(j(-0x14c, -0x167, -0x197, -0x181, -0x171, -0x141, -0x17b)) / 0x3) + parseInt(o(0x53, 0x47, 0x6e, 0x38," ascii
    $s9  = " 0x65, 0xa1, 0x77)) / 0x4 + -parseInt(p(-0x225, -0x220, -0x1ef, -0x1e9, -0x209, -0x21c, -0x210)) / 0x5 * (parseInt(p(-0x194, -0x" ascii
    $s10 = ", -0x394, -0x392) + 'FIxqOgMKi>0D>0A>22OgAvAC>38>22' + '>2B>' + '20>2F>' + E8(0x147, 0x19c, 0x163, 0x180, 0x154, 0x1a2, 0x175) +" ascii
    $s11 = "0x66) + E6(-0xb3, -0x96, -0x8b, -0x7c, -0x7f, -0xb5, -0x9b) + '>5CpROgRa>22>2B>2' + '0>2F>2FIxqOgMKi>0D>0A>22mdAta>5C>5CmIcRosOf" ascii
    $s12 = "-0x64, -0x5b, -0x85, -0x75, -0x6d, -0x68) + '>2B>20>2F>2FIxq' + 'OgMKi>0D>0A>22>20Power>22>2BoMKilXfTnLOHCUhAFBP>' + EO(0x15d, 0" ascii
    $s13 = "20SQ>22>2B>' + E7(0x2ad, 0x2a2, 0x29b, 0x2a7, 0x29c, 0x278, 0x271) + EA(-0x53, -0x75, -0x7d, -0x3e, -0x77, -0x60, -0x22) + E8(0x" ascii
    $s14 = "b, 0x21f, 0x20f, 0x1fd, 0x24e) + E6(-0xc8, -0x97, -0x7b, -0x72, -0x79, -0x66, -0xba) + E9(-0x3a0, -0x379, -0x381, -0x39e, -0x384" ascii
    $s15 = ", 0x1b1, 0x1c3)] + Ee(-0x111, -0xf5, -0xe0, -0xed, -0x10d, -0x11c, -0xbc))[ED(0x3dc, 0x3ab, 0x3cd, 0x3ea, 0x3da, 0x3ac, 0x3a9)](" ascii
    $s16 = "x2c3) + 'b>20>3D>20new>2' + E8(0x163, 0x191, 0x157, 0x15d, 0x18b, 0x171, 0x176) + E6(-0x63, -0x46, -0x3f, -0x20, -0x20, -0x13, -" ascii
    $s17 = "+ EA(-0x36, -0x47, -0x63, 0x1, -0x39, -0x2e, -0x1) + E6(-0x50, -0x47, -0x78, -0x6b, -0x14, -0x2b, -0x77) + EE(0x1ec, 0x233, 0x22" ascii
    $s18 = "89, -0x29d, -0x2ad, -0x294, -0x2ae)](R, Z['UJXkI']))) {" fullword ascii
    $s19 = "53, -0x172, -0x184, -0x154, -0x192, -0x1a4)]('counter');" fullword ascii
    $s20 = "t>5C>5CwINdoWs>22>29>29>2' + '0>7B>0D>0A>2F>' + '2FYhALZvBkf' + 'yGVcEPoHRNqI' + EE(0x210, 0x1ef, 0x221, 0x21b, 0x24b, 0x1f1, 0x" ascii

  condition:
    uint16(0) == 0x7566 and filesize < 80KB and
    1 of ($x*) and 4 of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

163ae647-9f7b-4ce8-8dcc-473e2a9cacbf

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion