lyceum_dotnet_http_backdoor

YARA-2025-2150 High general Active

No description available for this rule

lyceum_dotnet_http_backdoor.yar Valid Syntax

rule lyceum_dotnet_http_backdoor
{
    meta:
        author = "CPR"
        reference = "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/"
        hash1 = "1c444ebeba24dcba8628b7dfe5fec7c6"
        hash2 = "85ca334f87667bd7fa0c47ae6149353e"
        hash3 = "73bddd5f1a0847ae5f5d55e7d9c177f6"
        hash4 = "9fb86915db1b7c00f1a4587de4e052de"
        hash5 = "37fe608983d4b06a5549247f0e16bc11"
        hash6 = "5916e5189ef0050dfcc3cc19382d08d5"
    strings:
        $class1 = "Funcss"
        $class2 = "Constantss"
        $class3 = "Reqss"
        $class4 = "Screenss"
        $class5 = "Shll"
        $class6 = "test_A1"
        $class7 = "Uploadss"
        $class8 = "WebDL"
        $cnc_uri1 = "/upload" wide
        $cnc_uri2 = "/screenshot" wide
        $cnc_pattern_hex1 = {43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 7b 30 7d 22 0d 0a 0d 0a}
        $cnc_pattern_hex2 = {6d 75 6c 74 69 70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 20 62 6f 75 6e 64 61 72 79 3d 7b 30 7d}
        $cnc_pattern_hex3 = {43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 7b 30 7d 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 7b 31 7d 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 7b 32 7d 0d 0a 0d 0a}
        $constant1 = "FILE_DIR_SEPARATOR"
        $constant2 = "APPS_PARAMS_SEPARATOR"
        $constant3 = "TYPE_SENDTOKEN"
        $constant4 = "TYPE_DATA1"
        $constant5 = "TYPE_SEND_RESPONSE_IN_SOCKET"
        $constant6 = "TYPE_FILES_LIST"
        $constant7 = "TYPE_FILES_DELETE"
        $constant8 = "TYPE_FILES_RUN"
        $constant9 = "TYPE_FILES_UPLOAD_TO_SERVER"
        $constant10 = "TYPE_FILES_DELETE_FOLDER"
        $constant11 = "TYPE_FILES_CREATE_FOLDER"
        $constant12 = "TYPE_FILES_DOWNLOAD_URL"
        $constant13 = "TYPE_OPEN_CMD"
        $constant14 = "TYPE_CMD_RES"
        $constant15 = "TYPE_CLOSE_CMD"
        $constant16 = "TYPE_CMD_REQ"
        $constant17 = "TYPE_INSTALLED_APPS"
        $constant18 = "TYPE_SCREENSHOT"
        $constant19 = "_RG_APP_NAME_"
        $constant20 = "_RG_APP_VERSION_"
        $constant21 = "_RG_APP_DATE_"
        $constant22 = "_RG_APP_PUB_"
        $constant23 = "_RG_APP_SEP_"
        $constant24 = "_SC_EXT_"
    condition:
        uint16(0)==0x5a4d and (4 of ($class*) or 4 of ($cnc_*) or 4 of ($constant*))
}

Rule Metadata

author

CPR

reference

https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/

hash1

1c444ebeba24dcba8628b7dfe5fec7c6

hash2

85ca334f87667bd7fa0c47ae6149353e

hash3

73bddd5f1a0847ae5f5d55e7d9c177f6

hash4

9fb86915db1b7c00f1a4587de4e052de

hash5

37fe608983d4b06a5549247f0e16bc11

hash6

5916e5189ef0050dfcc3cc19382d08d5

String Definitions

{"name":"$class1","value":"\"Funcss\""}

{"name":"$class2","value":"\"Constantss\""}

{"name":"$class3","value":"\"Reqss\""}

{"name":"$class4","value":"\"Screenss\""}

{"name":"$class5","value":"\"Shll\""}

{"name":"$class6","value":"\"test_A1\""}

{"name":"$class7","value":"\"Uploadss\""}

{"name":"$class8","value":"\"WebDL\""}

{"name":"$cnc_uri1","value":"\"\/upload\" wide"}

{"name":"$cnc_uri2","value":"\"\/screenshot\" wide"}

{"name":"$cnc_pattern_hex1","value":"{43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 7b 30 7d 22 0d 0a 0d 0a}"}

{"name":"$cnc_pattern_hex2","value":"{6d 75 6c 74 69 70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 20 62 6f 75 6e 64 61 72 79 3d 7b 30 7d}"}

{"name":"$cnc_pattern_hex3","value":"{43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 7b 30 7d 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 7b 31 7d 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 7b 32 7d 0d 0a 0d 0a}"}

{"name":"$constant1","value":"\"FILE_DIR_SEPARATOR\""}

{"name":"$constant2","value":"\"APPS_PARAMS_SEPARATOR\""}

{"name":"$constant3","value":"\"TYPE_SENDTOKEN\""}

{"name":"$constant4","value":"\"TYPE_DATA1\""}

{"name":"$constant5","value":"\"TYPE_SEND_RESPONSE_IN_SOCKET\""}

{"name":"$constant6","value":"\"TYPE_FILES_LIST\""}

{"name":"$constant7","value":"\"TYPE_FILES_DELETE\""}

{"name":"$constant8","value":"\"TYPE_FILES_RUN\""}

{"name":"$constant9","value":"\"TYPE_FILES_UPLOAD_TO_SERVER\""}

{"name":"$constant10","value":"\"TYPE_FILES_DELETE_FOLDER\""}

{"name":"$constant11","value":"\"TYPE_FILES_CREATE_FOLDER\""}

{"name":"$constant12","value":"\"TYPE_FILES_DOWNLOAD_URL\""}

{"name":"$constant13","value":"\"TYPE_OPEN_CMD\""}

{"name":"$constant14","value":"\"TYPE_CMD_RES\""}

{"name":"$constant15","value":"\"TYPE_CLOSE_CMD\""}

{"name":"$constant16","value":"\"TYPE_CMD_REQ\""}

{"name":"$constant17","value":"\"TYPE_INSTALLED_APPS\""}

{"name":"$constant18","value":"\"TYPE_SCREENSHOT\""}

{"name":"$constant19","value":"\"_RG_APP_NAME_\""}

{"name":"$constant20","value":"\"_RG_APP_VERSION_\""}

{"name":"$constant21","value":"\"_RG_APP_DATE_\""}

{"name":"$constant22","value":"\"_RG_APP_PUB_\""}

{"name":"$constant23","value":"\"_RG_APP_SEP_\""}

{"name":"$constant24","value":"\"_SC_EXT_\""}

Threat Analysis

This YARA rule is designed to detect general threats.

Severity Level: High

The rule uses pattern matching to identify specific byte sequences, strings, or behavioral patterns associated with malicious activity.

Detection Capabilities

File-based detection for executables and documents
Memory scanning for running processes
Network traffic analysis support

Command Line Usage

# Scan a single file
yara lyceum_dotnet_http_backdoor.yar /path/to/suspicious/file

# Scan a directory recursively
yara -r lyceum_dotnet_http_backdoor.yar /path/to/directory/

# Scan with metadata output
yara -m lyceum_dotnet_http_backdoor.yar target_file

# Scan process memory (Linux)
yara lyceum_dotnet_http_backdoor.yar /proc/[pid]/exe

Integration Examples

Python (yara-python)

import yara
rules = yara.compile(filepath='lyceum_dotnet_http_backdoor.yar')
matches = rules.match('/path/to/file')

ClamAV Integration

clamscan --yara-rules=lyceum_dotnet_http_backdoor.yar /path/to/scan

Rule Information

YARA ID

YARA-2025-2150

Author

CPR

Repository

mikesxrs_Open-Source-YARA-rules

Created

August 19, 2025

Last Updated

August 19, 2025

Last Imported

Never

Threat Intelligence

Risk Level High

Category general

Detection Confidence Analysis Pending

False Positive Rate Not Available

Last Seen in Wild No Data

Related Rules

apt_actor_tran_duy_linh

Apolmy_Privesc_Trojan

YARA-2015-0069

Medium

Emissary_APT_Malware_1

YARA-2016-0154

Medium

Export Options

Similar Rules in general

YARA-2023-0001 CRI

lyceum_dotnet_http_backdoor

Rule Metadata

String Definitions

Threat Analysis

Detection Capabilities

Command Line Usage

Integration Examples

Python (yara-python)

ClamAV Integration

Rule Information

Threat Intelligence

Related Rules

Export Options

Similar Rules in general

Detect_Mimic_Ransomware

SystemBC_malware

detect_catB

detect_Typhon_Stealer

Nosu_stealer

detect_Lumma_stealer

detect_StrelaStealer

detect_silence_Downloader