MeldSecurity
Press Enter to search
CVE Database & Search →
Sign In Get Started

Emissary_APT_Malware_1

YARA-2016-0154 Medium general Active

Detect Emissary Malware - from samples A08E81B411.DAT, ishelp.dll

Emissary_APT_Malware_1.yar Valid Syntax 
/*
	Yara Rule Set
	Author: Florian Roth
	Date: 2016-01-02
	Identifier: Emissary Malware
*/

rule Emissary_APT_Malware_1 {
	meta:
		description = "Detect Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
		author = "Florian Roth"
		reference = "http://goo.gl/V0epcf"
		date = "2016-01-02"
		score = 75
		hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
		hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
		hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
		hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
		hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
		hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
		hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
		hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
		hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
		hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
		hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
		hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
		hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
	strings:
		$s1 = "cmd.exe /c %s > %s" fullword ascii
		$s2 = "execute cmd timeout." fullword ascii
		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
		$s4 = "DownloadFile - exception:%s." fullword ascii
		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
		$s7 = "WinDLL.dll" fullword wide
		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 250KB and 3 of them
}

Rule Metadata

description
Detect Emissary Malware - from samples A08E81B411.DAT, ishelp.dll
author
Florian Roth
reference
http://goo.gl/V0epcf
date
2016-01-02
hash1
9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab
hash2
70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629
hash3
0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290
hash4
69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664
hash5
675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc
hash6
e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b
hash7
a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8
hash8
acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9
hash9
e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d
hash10
e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538
hash11
29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051
hash12
98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0
hash13
fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb

String Definitions

{"name":"$s1","value":"\"cmd.exe \/c %s > %s\" fullword ascii"}
{"name":"$s2","value":"\"execute cmd timeout.\" fullword ascii"}
{"name":"$s3","value":"\"rundll32.exe \\\"%s\\\",Setting\" fullword ascii"}
{"name":"$s4","value":"\"DownloadFile - exception:%s.\" fullword ascii"}
{"name":"$s5","value":"\"CDllApp::InitInstance() - Evnet create successful.\" fullword ascii"}
{"name":"$s6","value":"\"UploadFile - EncryptBuffer Error\" fullword ascii"}
{"name":"$s7","value":"\"WinDLL.dll\" fullword wide"}
{"name":"$s8","value":"\"DownloadFile - exception:%s,code:0x%08x.\" fullword ascii"}
{"name":"$s9","value":"\"Mozilla\/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\" fullword ascii"}
{"name":"$s10","value":"\"CDllApp::InitInstance() - Evnet already exists.\" fullword ascii"}

Threat Analysis

This YARA rule is designed to detect general threats.

Severity Level: Medium

The rule uses pattern matching to identify specific byte sequences, strings, or behavioral patterns associated with malicious activity.

Detection Capabilities

  • File-based detection for executables and documents
  • Memory scanning for running processes
  • Network traffic analysis support

Command Line Usage

# Scan a single file
yara Emissary_APT_Malware_1.yar /path/to/suspicious/file

# Scan a directory recursively
yara -r Emissary_APT_Malware_1.yar /path/to/directory/

# Scan with metadata output
yara -m Emissary_APT_Malware_1.yar target_file

# Scan process memory (Linux)
yara Emissary_APT_Malware_1.yar /proc/[pid]/exe

Integration Examples

Python (yara-python)

import yara
rules = yara.compile(filepath='Emissary_APT_Malware_1.yar')
matches = rules.match('/path/to/file')

ClamAV Integration

clamscan --yara-rules=Emissary_APT_Malware_1.yar /path/to/scan

Rule Information

YARA ID
YARA-2016-0154
Created
August 19, 2025
Last Updated
August 19, 2025
Last Imported
Never

Threat Intelligence

Risk Level Medium
Category general
Detection Confidence Analysis Pending
False Positive Rate Not Available
Last Seen in Wild No Data

Related Rules

apt_actor_tran_duy_linh
YARA-2025-1093
Medium
backoff
YARA-2014-0023
Medium
APT20140414_1PE
YARA-2025-1094
Medium
Apolmy_Privesc_Trojan
YARA-2015-0069
Medium
AdGholas_mem_antisec_M2
YARA-2025-1095
Medium

Export Options

Similar Rules in general

YARA-2023-0001 CRI

Detect_Mimic_Ransomware

Detect_Mimic_Ransomware
YARA-2023-0002 MED

SystemBC_malware

Detect_SystemBC
YARA-2023-0003 MED

detect_catB

detect_CatB_ransomware
YARA-2022-0001 MED

detect_Typhon_Stealer

detect_Typhon_Stealer
YARA-2023-0004 MED

Nosu_stealer

Detect_Nosu_stealer
YARA-2022-0002 MED

detect_Lumma_stealer

detect_Lumma_stealer
YARA-2022-0003 MED

detect_StrelaStealer

detect_StrelaStealer
YARA-2022-0004 MED

detect_silence_Downloader

detect_silence_Downloader