Solarmarker_Dropper

YARA-2025-0124 Medium general Active

Based on import hash and string observations with March 2022 solarmarker dropper

Solarmarker_Dropper.yar Valid Syntax
import "pe"
/*
 This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
rule Solarmarker_Dropper
{
   meta:
        author = "Lucas Acha (http://www.lukeacha.com)"
        description = "Based on import hash and string observations with March 2022 solarmarker dropper"
        reference = "http://security5magics.blogspot.com/2020/12/tracking-jupyter-malware.html" 
  strings:
      $htt1 = "PowerShell"
	    $htt2 = "System.Collections.ObjectModel"
      $htt3 = "System.Management.Automation"
      $htt4 = ".NETFramework"
      $htt5 = "HashAlgorithm"
  condition:
      pe.imphash() == "b8bb385806b89680e13fc0cf24f4431e" and 3 of ($htt*)
}

Rule Metadata

author
Lucas Acha (http://www.lukeacha.com)
description
Based on import hash and string observations with March 2022 solarmarker dropper
reference
http://security5magics.blogspot.com/2020/12/tracking-jupyter-malware.html

String Definitions

{"name":"$htt1","value":"\"PowerShell\""}
{"name":"$htt2","value":"\"System.Collections.ObjectModel\""}
{"name":"$htt3","value":"\"System.Management.Automation\""}
{"name":"$htt4","value":"\".NETFramework\""}
{"name":"$htt5","value":"\"HashAlgorithm\""}

Threat Analysis

This YARA rule is designed to detect general threats.

Severity Level: Medium

The rule uses pattern matching to identify specific byte sequences, strings, or behavioral patterns associated with malicious activity.

Detection Capabilities

  • File-based detection for executables and documents
  • Memory scanning for running processes
  • Network traffic analysis support

Command Line Usage

# Scan a single file
yara Solarmarker_Dropper.yar /path/to/suspicious/file

# Scan a directory recursively
yara -r Solarmarker_Dropper.yar /path/to/directory/

# Scan with metadata output
yara -m Solarmarker_Dropper.yar target_file

# Scan process memory (Linux)
yara Solarmarker_Dropper.yar /proc/[pid]/exe

Integration Examples

Python (yara-python)

import yara
rules = yara.compile(filepath='Solarmarker_Dropper.yar')
matches = rules.match('/path/to/file')

ClamAV Integration

clamscan --yara-rules=Solarmarker_Dropper.yar /path/to/scan

Rule Information

YARA ID
YARA-2025-0124
Created
August 19, 2025
Last Updated
August 19, 2025
Last Imported
Never

Threat Intelligence

Risk Level Medium
Category general
Detection Confidence Analysis Pending
False Positive Rate Not Available
Last Seen in Wild No Data

Export Options