SYMBOLCOMMON_NAMEaka. SYNONYMS
win.highnoon_bin (Back to overview)

HIGHNOON.BIN

Actor(s): APT41


There is no description at this point.

References
2019-08-09FireEyeFireEye
@online{fireeye:20190809:double:40f736e, author = {FireEye}, title = {{Double Dragon APT41, a dual espionage and cyber crime operation}}, date = {2019-08-09}, organization = {FireEye}, url = {https://content.fireeye.com/apt-41/rpt-apt41/}, language = {English}, urldate = {2019-12-18} } Double Dragon APT41, a dual espionage and cyber crime operation
CLASSFON crackshot CROSSWALK GEARSHIFT HIGHNOON HIGHNOON.BIN JUMPALL poisonplug Winnti
Yara Rules
[TLP:WHITE] win_highnoon_bin_w0 (20190812 | Detects APT41 malware HIGHNOON.BIN)
import "pe"
/*
   Yara Rule Set
   Author: Florian Roth
   Date: 2019-08-07
   Identifier: APT41
   Reference: https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html
   License: https://creativecommons.org/licenses/by-nc/4.0/
*/

rule win_highnoon_bin_w0 {
    meta:
        description = "Detects APT41 malware HIGHNOON.BIN"
        author = "Florian Roth"
        reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
        date = "2019-08-07"
        score = 90
        hash1 = "490c3e4af829e85751a44d21b25de1781cfe4961afdef6bb5759d9451f530994"
        hash2 = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.highnoon_bin"
        malpedia_version = "20190812"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $s1 = "PlusDll.dll" fullword ascii
        $s2 = "\\Device\\PORTLESS_DeviceName" fullword wide
        $s3 = "%s%s\\Security" fullword ascii
        $s4 = "%s\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
        $s5 = "%s%s\\Enum" fullword ascii
    condition:
        pe.imphash() == "b70358b00dd0138566ac940d0da26a03" or 3 of them
}
Download all Yara Rules