SYMBOLCOMMON_NAMEaka. SYNONYMS
win.hoplight (Back to overview)

HOPLIGHT

aka: HANGMAN

Actor(s): Lazarus Group

VTCollection    

There is no description at this point.

References
2020-02-25SentinelOneJim Walter
DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity
ARTFULPIE BISTROMATH BUFFETLINE CHEESETRAY HOPLIGHT HOTCROISSANT SLICKSHOES
2020-02-19LexfoLexfo
The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor
2020-02-14US-CERTUS-CERT
Malware Analysis Report (AR20-045G): MAR-10135536-8.v4 - North Korean Trojan: HOPLIGHT
HOPLIGHT
2020-02-13QianxinQi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2020-01-01SecureworksSecureWorks
NICKEL ACADEMY
Brambul Duuzer HOPLIGHT Joanap Sierra(Alfa,Bravo, ...) Volgmer
2019-10-31CISACISA
Malware Analysis Report (AR19-304A)
HOPLIGHT
2019-08-01Kaspersky LabsGReAT
APT trends report Q2 2019
ZooPark magecart POWERSTATS Chaperone COMpfun EternalPetya FinFisher RAT HawkEye Keylogger HOPLIGHT Microcin NjRAT Olympic Destroyer PLEAD RokRAT Triton Zebrocy
2019-04-11Computing.co.ukDev Kundaliya
Lazarus rises: Warning over new HOPLIGHT malware linked with North Korea
HOPLIGHT
2019-04-10US-CERTUS-CERT
Malware Analysis Report (AR19-100A): North Korean Trojan: HOPLIGHT
HOPLIGHT
2017-08-14Palo Alto Networks Unit 42Anthony Kasza
The Blockbuster Saga Continues
HOPLIGHT
2015-09-10FireEyeGenwei Jiang, Josiah Kimble
Hangul Word Processor (HWP)Zero-Day: possible ties to North Korean threat actors
HOPLIGHT
Yara Rules
[TLP:WHITE] win_hoplight_auto (20230808 | Detects win.hoplight.)
rule win_hoplight_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.hoplight."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hoplight"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 488b4c2460 e8???????? 8b442428 488d0d5e680200 }
            // n = 4, score = 100
            //   488b4c2460           | mov                 dword ptr [esp + 0xf8], eax
            //   e8????????           |                     
            //   8b442428             | mov                 dword ptr [esp + 0x28], 0
            //   488d0d5e680200       | dec                 eax

        $sequence_1 = { 488b5260 8b0481 894208 488b842480000000 }
            // n = 4, score = 100
            //   488b5260             | mov                 eax, dword ptr [esp + 0x110]
            //   8b0481               | dec                 eax
            //   894208               | mov                 ecx, dword ptr [esp + 0x60]
            //   488b842480000000     | mov                 eax, dword ptr [esp + 0x28]

        $sequence_2 = { 8b442424 25ff000000 8bc0 488d0d87740200 }
            // n = 4, score = 100
            //   8b442424             | mov                 eax, dword ptr [esp + 0x24]
            //   25ff000000           | and                 eax, 0xff
            //   8bc0                 | mov                 eax, eax
            //   488d0d87740200       | dec                 eax

        $sequence_3 = { 4889542420 4d8bc8 488b442440 4c8bc0 }
            // n = 4, score = 100
            //   4889542420           | mov                 edx, dword ptr [edx + 0x60]
            //   4d8bc8               | mov                 eax, dword ptr [ecx + eax*4]
            //   488b442440           | mov                 dword ptr [edx + 8], eax
            //   4c8bc0               | dec                 eax

        $sequence_4 = { 4c8bb42498040000 488b8d80030000 4833cc e8???????? }
            // n = 4, score = 100
            //   4c8bb42498040000     | dec                 eax
            //   488b8d80030000       | lea                 ecx, [0x2685e]
            //   4833cc               | dec                 eax
            //   e8????????           |                     

        $sequence_5 = { 488d4c2460 e8???????? 488b842470020000 488b4060 }
            // n = 4, score = 100
            //   488d4c2460           | mov                 eax, dword ptr [esp + 0x80]
            //   e8????????           |                     
            //   488b842470020000     | dec                 esp
            //   488b4060             | mov                 esi, dword ptr [esp + 0x498]

        $sequence_6 = { 4833c4 48898424f8000000 c744242800000000 488b842410010000 }
            // n = 4, score = 100
            //   4833c4               | lea                 ecx, [0x27487]
            //   48898424f8000000     | dec                 eax
            //   c744242800000000     | xor                 eax, esp
            //   488b842410010000     | dec                 eax

        $sequence_7 = { 4c8d05883c0300 488bd0 488b4c2450 e8???????? }
            // n = 4, score = 100
            //   4c8d05883c0300       | dec                 eax
            //   488bd0               | mov                 ecx, dword ptr [ebp + 0x380]
            //   488b4c2450           | dec                 eax
            //   e8????????           |                     

    condition:
        7 of them and filesize < 765952
}
Download all Yara Rules