Skip to content

Commit 6bafbcf

Browse files
octo-sts-2[bot]github-actions[bot]
octo-sts-2[bot]
and
github-actions[bot]
authored
Update third-party rules as of 2026-03-09 (#1417)
Co-authored-by: Update third-party rules <41898282+github-actions[bot]@users.noreply.github.com>
1 parent d87120b commit 6bafbcf

8 files changed

Lines changed: 267 additions & 1 deletion

File tree

‎third_party/yara/JPCERT/Atlas.yara‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
import "pe"
2+
3+
rule malware_AtlasLoader {
4+
meta:
5+
description = "AtlasLoader"
6+
author = "JPCERT/CC Incident Response Group"
7+
hash = "11aa581aff8010e4030fdbd3c620d8d75506b1b642393b36a7bddefcbb087e31"
8+
created_date = "2026-02-09"
9+
updated_date = "2026-02-09"
10+
11+
strings:
12+
$s1 = "RunPluin" ascii
13+
$s2 = "AtlasPro" wide
14+
$s3 = "AtlasInfo" ascii
15+
$s4 = "MainDll.dll" ascii
16+
17+
condition:
18+
uint16(0) == 0x5a4d and
19+
uint32(uint32(0x3c)) == 0x00004550 and
20+
3 of them
21+
}
22+
23+
rule malware_AtlasPlugin {
24+
meta:
25+
description = "AtlasLoader Plugin"
26+
author = "JPCERT/CC Incident Response Group"
27+
hash1 = "17452364cdf00c8bdcd9b659253043e37ff76cd044d85d8055b6cc04b2e98302"
28+
hash2 = "6d5eafc6715f221b8e6e0f81f48a37c214fa4abcc0d7a5c2b15ffcce0309fa62"
29+
created_date = "2026-03-06"
30+
updated_date = "2026-03-06"
31+
32+
strings:
33+
$s1 = "AtlasPro" wide
34+
$s2 = "LoginAddress" wide
35+
$s3 = "LoginPort" wide
36+
$s4 = "C:\\Users\\xxx85\\Desktop\\atlasPro" ascii
37+
$s5 = "修改通信加密+加载器\\Release\\Plugin\\x64" ascii wide
38+
39+
condition:
40+
pe.exports("RunPluin") and
41+
3 of them
42+
}

‎third_party/yara/JPCERT/Kimsuky.yara‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,60 @@ rule kimsuky_downloader_pe
7171
all of ($dotnet*) and
7272
3 of ($s*)
7373
}
74+
75+
rule kimsuky_uploader_github_ps1 {
76+
meta:
77+
description = "Powershell script to upload device information to GitHub"
78+
author = "JPCERT/CC Incident Response Group"
79+
hash = "d4054495cfabbf511fb2f860487cb1d9e969e0a571bcb5e5c88f7d1ab75c0c09"
80+
created_date = "2025-12-19"
81+
updated_date = "2025-12-19"
82+
83+
strings:
84+
$s1 = "-XXX-kkk.txt" ascii
85+
$s2 = "-0956_info.txt" ascii
86+
$s3 = "branch = \"main" ascii
87+
$s4 = "message = \"Upload file $" ascii
88+
$s5 = "Get-Date -Format \"MMdd_HHmm\"" ascii
89+
$s6 = "Write-Output \"Note\" | Out-File" ascii
90+
91+
condition:
92+
3 of them
93+
}
94+
95+
rule kimsuky_initial_downloader_github_ps1 {
96+
meta:
97+
description = "Powershell script to download ps1 from GitHub and set by scheduled task"
98+
author = "JPCERT/CC Incident Response Group"
99+
hash = "0b50547274455ee876512687d8bd24911a97429d2642dff8aeb6c42c7601fe53"
100+
created_date = "2025-12-19"
101+
updated_date = "2025-12-19"
102+
103+
strings:
104+
$s1 = "($env:AppData) \\\"whale.ps1" ascii
105+
$s2 = "($env:AppData) \"Doks.ps1" ascii
106+
$s3 = "=\"ghp_" ascii
107+
$s4 = "vnd.github.v3.raw" ascii
108+
$s5 = "New-ScheduledTaskAction -Execute 'PowerShell.exe'" ascii
109+
110+
condition:
111+
3 of them
112+
}
113+
114+
rule kimsuky_downloader_github_ps1 {
115+
meta:
116+
description = "Powershell script to download ps1 from GitHub"
117+
author = "JPCERT/CC Incident Response Group"
118+
hash = "938650b7ef26cc4ff3586414734a30c7fbc4a0ec82459305000d6778660deb59"
119+
created_date = "2025-12-19"
120+
updated_date = "2025-12-19"
121+
122+
strings:
123+
$s1 = "($env:AppData) \"Doks.ps1" ascii
124+
$s2 = "Authorization=\"token ghp_" ascii
125+
$s3 = "vnd.github.v3.raw" ascii
126+
127+
condition:
128+
all of them
129+
}
130+

‎third_party/yara/JPCERT/RELEASE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
9315b430b0dbbb0db4da9196373ec8e26a538608
1+
7837438e7bcb100bcc7f9d2be09152b19d967c0c

‎third_party/yara/JPCERT/blacktech.yara‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -456,3 +456,40 @@ rule BlackTech_AresPYDoor_str {
456456
condition:
457457
5 of them
458458
}
459+
460+
rule malware_Kivars_Loader {
461+
meta:
462+
description = "Kivars Loader"
463+
author = "JPCERT/CC Incident Response Group"
464+
hash = "35efb2661b580866ef9a29770ff960c105edb1239a5d4279e7e6b4e9f9b6256a"
465+
created_date = "2025-11-25"
466+
updated_date = "2025-11-25"
467+
reference = "https://sect.iij.ad.jp/blog/2025/10/blacktech-malware-kivars-2025/"
468+
469+
strings:
470+
$dll_name = "sericeMain.dll" ascii
471+
$custom_rc4 = {41 02 02 32 C1 41 88 02 EB ?? 41 32 0A [0-1] 02 CB 41 88 0A 49 FF C2}
472+
473+
condition:
474+
uint16(0) == 0x5A4D and
475+
all of them
476+
}
477+
478+
rule malware_Kivars {
479+
meta:
480+
description = "Kivars"
481+
author = "JPCERT/CC Incident Response Group"
482+
hash = "5a9f96217530b68c2fc7a06f25b52062dbcc8dd2760de0f7dca3456af2dc4bec"
483+
created_date = "2025-11-25"
484+
updated_date = "2025-11-25"
485+
reference = "https://sect.iij.ad.jp/blog/2025/10/blacktech-malware-kivars-2025/"
486+
487+
strings:
488+
$s1 = {25 73 5C 25 73 07 33 25 75 07 34 25 75 2D 25 2E 32 75 2D 25 2E 32 75 20 25 2E 32 75 3A 25 2E 32 75 00}
489+
$s2 = {58 C6 84 24 ?? ?? ?? ?? 45 C6 84 24 ?? ?? ?? ?? 43 C6 84 24 ?? ?? ?? ?? 50 C6 84 24 ?? ?? ?? ?? 52 C6 84 24 ?? ?? ?? ?? 4F C6 84 24 ?? ?? ?? ?? 42 C6 84 24 ?? ?? ?? ?? 45} // XECPROBELOADER
490+
$custom_rc4 = {41 02 02 32 C1 41 88 02 EB ?? 41 32 0A [0-1] 02 CB 41 88 0A 49 FF C2}
491+
492+
condition:
493+
uint16(0) == 0x5A4D and
494+
2 of them
495+
}

‎third_party/yara/JPCERT/fortinet.yara‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
rule malware_GETRdoor {
2+
meta:
3+
description = "ELF backdoor targeting FortiGate"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "9da731d152c57e90cc95bc58aa55c0873005a747fda0d45529e964bdbc9dc18c"
6+
created_date = "2025-11-14"
7+
updated_date = "2025-11-20"
8+
9+
strings:
10+
$s1 = "do_upload: file open failed" ascii
11+
$s2 = "/bin/snifferd" ascii
12+
$s3 = "tcp[(tcp[12]>>2):%d] = 0x%s" ascii
13+
$s4 = {00 34 37 34 35 35 34 35 32 00} // 47455452
14+
$s5 = "diagnose debug crashlog clear" ascii
15+
$s6 = {00 0A 30 78 30 30 30 30 00} // \n0x0000
16+
17+
condition:
18+
uint32(0) == 0x464C457F and
19+
3 of them
20+
}
21+
22+
rule malware_PELdoor {
23+
meta:
24+
description = "ELF backdoor"
25+
author = "JPCERT/CC Incident Response Group"
26+
hash = "7991d64a23a6630453b5a68d4082e713d501082535e53b7e84d98b8ec7eee7a9"
27+
created_date = "2025-11-20"
28+
updated_date = "2025-11-20"
29+
30+
strings:
31+
$s1 = "sxcdewqaz!@#" ascii
32+
$s2 = ";7(Zu9YTsA7qQ#vw" ascii
33+
$s3 = "/var/run/miglogd000.pid" ascii
34+
$s4 = "/tmp/tmplog.tar" ascii
35+
$s5 = {66 3D FB 20 74 ?? 48 8B 45 ?? 0F B7 40 ?? 0F B7 C0 89 C7 E8 ?? ?? ?? ?? 66 3D 1D 02}
36+
37+
condition:
38+
uint32(0) == 0x464C457F and
39+
3 of them
40+
}
41+
42+
rule malware_SHADYMARY {
43+
meta:
44+
description = "SHADYMARY malware"
45+
author = "JPCERT/CC Incident Response Group"
46+
hash = "1d347944b6cf8ecc54474149e9bcee0108919a293bed348a46228dca3d095618"
47+
created_date = "2025-11-20"
48+
updated_date = "2025-11-20"
49+
50+
strings:
51+
$s1 = "/data2/libcrashpad.so" ascii
52+
$s2 = "/bin/smit" ascii
53+
$s3 = "injector return %d" ascii
54+
$s4 = "injector__call_syscall" ascii
55+
56+
condition:
57+
uint32(0) == 0x464C457F and
58+
2 of them
59+
}

‎third_party/yara/JPCERT/phantomstealer.yara‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule malware_PhantomStealer {
2+
meta:
3+
description = "phantom stealer"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "3e6c9cb5304d932483a0f0198a7c727d4898bcd4110b15cf2c7f7a731b2f195d"
6+
rule_usage = "memory scan"
7+
created_date = "2025-11-25"
8+
updated_date = "2025-11-25"
9+
10+
strings:
11+
$s1 = "Phantom stealer" wide
12+
$s2 = "Phantom-DebugFile.log" wide
13+
$s3 = "Chrome_Phantom" wide
14+
15+
condition:
16+
2 of them
17+
}

‎third_party/yara/JPCERT/snakekeylogger.yara‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
rule malware_SnakeKeylogger {
2+
meta:
3+
description = "Snake Keylogger (a.k.a. VIP Recovery)"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "e7b49b01463ba069ef6b17e39fea65f06882a23bcbf821e52c5ef357cee141c5"
6+
rule_usage = "memory scan"
7+
created_date = "2025-11-25"
8+
updated_date = "2025-11-25"
9+
10+
strings:
11+
$s1 = "VIP Recovery \\ --------" wide
12+
$s2 = "Keylogger_Recovered" wide
13+
14+
condition:
15+
all of them
16+
}

‎third_party/yara/JPCERT/unc5174.yara‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
rule malware_SNOWLIGHT_loader {
2+
meta:
3+
description = "shellcode loader"
4+
author = "JPCERT/CC Incident Response Group"
5+
hash = "946f3935a4f69824e16bf815c3385cf6c1af4a5dd8df673861c286b8b65d7771"
6+
created_date = "2025-11-25"
7+
updated_date = "2025-11-25"
8+
reference = "https://sect.iij.ad.jp/blog/2025/11/unc5174-windows-snowlight-in-2025/"
9+
10+
strings:
11+
$s1 = "Global\\MicrosoftEdgeUpdate" wide
12+
$s2 = {41 74 6C 54 68 75 6E 6B 5F 44 61 74 61 54 6F 43 00} // AtlThunk_DataToC
13+
$decode = {81 34 08 77 57 82 66 83 C0 04 3B C6 7C}
14+
15+
condition:
16+
uint16(0) == 0x5A4D and
17+
2 of them
18+
}
19+
20+
rule malware_SNOWLIGHT_ELF {
21+
meta:
22+
description = "SNOWLIGHT"
23+
author = "JPCERT/CC Incident Response Group"
24+
hash = "d4ce9744ab67f5c2298313a997b97e421de31f464e990d02dd4e55bf1fc5043d"
25+
created_date = "2025-11-25"
26+
updated_date = "2025-11-25"
27+
reference = "https://sect.iij.ad.jp/blog/2025/11/unc5174-windows-snowlight-in-2025/"
28+
29+
strings:
30+
$s1 = "/tmp/log_de.log" ascii
31+
$s2 = "GET /?a=%s&h=%s&t=%s&p=%d HTTP/1.1" ascii
32+
$s3 = "[kworker/0:2]" ascii
33+
$decode = {80 30 99 48 FF C0 89 C6 29 EE 39 CE 7C}
34+
35+
condition:
36+
uint32(0) == 0x464C457F and
37+
3 of them
38+
}

0 commit comments

Comments
 (0)