NK_GOLDBACKDOOR_generic_shellcode

YARA-2025-1521 High general Active

Generic detection for shellcode used to drop GOLDBACKDOOR

NK_GOLDBACKDOOR_generic_shellcode.yar Valid Syntax
rule NK_GOLDBACKDOOR_generic_shellcode
{
meta:
author= "Silas Cutler (silas@Stairwell.com)"
description = "Generic detection for shellcode used to drop GOLDBACKDOOR"
reference = "https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/"
version = "0.1"
strings:
$ = { B9 8E 8A DD 8D 8B F0 E8 ?? ?? ?? ?? FF D0 }
$ = { B9 8E AB 6F 40 [1-10] 50 [1-10] E8 ?? ?? ?? ?? FF D0 }
condition:
all of them
}

Rule Metadata

author
Silas Cutler (silas@Stairwell.com)
description
Generic detection for shellcode used to drop GOLDBACKDOOR
reference
https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/
version
0.1

Threat Analysis

This YARA rule is designed to detect general threats.

Severity Level: High

The rule uses pattern matching to identify specific byte sequences, strings, or behavioral patterns associated with malicious activity.

Detection Capabilities

  • File-based detection for executables and documents
  • Memory scanning for running processes
  • Network traffic analysis support

Command Line Usage

# Scan a single file
yara NK_GOLDBACKDOOR_generic_shellcode.yar /path/to/suspicious/file

# Scan a directory recursively
yara -r NK_GOLDBACKDOOR_generic_shellcode.yar /path/to/directory/

# Scan with metadata output
yara -m NK_GOLDBACKDOOR_generic_shellcode.yar target_file

# Scan process memory (Linux)
yara NK_GOLDBACKDOOR_generic_shellcode.yar /proc/[pid]/exe

Integration Examples

Python (yara-python)

import yara
rules = yara.compile(filepath='NK_GOLDBACKDOOR_generic_shellcode.yar')
matches = rules.match('/path/to/file')

ClamAV Integration

clamscan --yara-rules=NK_GOLDBACKDOOR_generic_shellcode.yar /path/to/scan

Rule Information

YARA ID
YARA-2025-1521
Created
August 19, 2025
Last Updated
August 19, 2025
Last Imported
Never

Threat Intelligence

Risk Level High
Category general
Detection Confidence Analysis Pending
False Positive Rate Not Available
Last Seen in Wild No Data

Export Options