SYMBOLCOMMON_NAMEaka. SYNONYMS
win.nachocheese (Back to overview)

NACHOCHEESE

aka: Cyruslish, TWOPENCE, VIVACIOUSGIFT

Actor(s): Lazarus Group

VTCollection    

According to FireEye, NACHOCHEESE is a command-line tunneler that accepts delimited C&C IPs or domains via command-line and gives actors shell access to a victim's system.

References
2020-08-26CISACISA
MAR-10301706-2.v1 - North Korean Remote Access Tool: VIVACIOUSGIFT
NACHOCHEESE
2020-02-19LexfoLexfo
The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor
2018-10-03Virus BulletinMichal Poslušný, Peter Kálnai
Lazarus Group A Mahjong Game Played with Different Sets of Tiles
Bankshot BanPolMex RAT FuwuqiDrama HOTWAX KillDisk (Lazarus) NACHOCHEESE REDSHAWL WannaCryptor
2018-01-01FireEyeFireEye
APT38
CHEESETRAY CLEANTOAD NACHOCHEESE
2017-05-30Group-IBGroup-IB
Lazarus Arisen: Architecture, Techniques and Attribution
HOTWAX NACHOCHEESE Ratankba
2017-02-20BAE SystemsSergei Shevchenko
Lazarus’ False Flag Malware
HOTWAX NACHOCHEESE
2017-02-16ESET ResearchPeter Kálnai
Demystifying targeted malware used against Polish banks
BanPolMex RAT HOTWAX NACHOCHEESE
Yara Rules
[TLP:WHITE] win_nachocheese_auto (20230808 | Detects win.nachocheese.)
rule win_nachocheese_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.nachocheese."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nachocheese"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3d9c000000 7c07 3d9f000000 7e0d 33c0 c3 05d13fffff }
            // n = 7, score = 300
            //   3d9c000000           | cmp                 eax, 0x9c
            //   7c07                 | jl                  9
            //   3d9f000000           | cmp                 eax, 0x9f
            //   7e0d                 | jle                 0xf
            //   33c0                 | xor                 eax, eax
            //   c3                   | ret                 
            //   05d13fffff           | add                 eax, 0xffff3fd1

        $sequence_1 = { 33f6 397508 0f8ec9000000 b8???????? 48 }
            // n = 5, score = 300
            //   33f6                 | xor                 esi, esi
            //   397508               | cmp                 dword ptr [ebp + 8], esi
            //   0f8ec9000000         | jle                 0xcf
            //   b8????????           |                     
            //   48                   | dec                 eax

        $sequence_2 = { 2bfa 8d47fd 3901 8901 }
            // n = 4, score = 300
            //   2bfa                 | sub                 edi, edx
            //   8d47fd               | lea                 eax, [edi - 3]
            //   3901                 | cmp                 dword ptr [ecx], eax
            //   8901                 | mov                 dword ptr [ecx], eax

        $sequence_3 = { 02ca 880c3e 8a5005 32d1 8b4dfc 88143e 8a4c0105 }
            // n = 7, score = 300
            //   02ca                 | add                 cl, dl
            //   880c3e               | mov                 byte ptr [esi + edi], cl
            //   8a5005               | mov                 dl, byte ptr [eax + 5]
            //   32d1                 | xor                 dl, cl
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   88143e               | mov                 byte ptr [esi + edi], dl
            //   8a4c0105             | mov                 cl, byte ptr [ecx + eax + 5]

        $sequence_4 = { 7305 83c303 eb1c 81fb00000100 }
            // n = 4, score = 300
            //   7305                 | jae                 7
            //   83c303               | add                 ebx, 3
            //   eb1c                 | jmp                 0x1e
            //   81fb00000100         | cmp                 ebx, 0x10000

        $sequence_5 = { 33c8 894710 8b4708 33c1 }
            // n = 4, score = 300
            //   33c8                 | xor                 ecx, eax
            //   894710               | mov                 dword ptr [edi + 0x10], eax
            //   8b4708               | mov                 eax, dword ptr [edi + 8]
            //   33c1                 | xor                 eax, ecx

        $sequence_6 = { 7305 83c304 eb0f 81fb00000001 }
            // n = 4, score = 300
            //   7305                 | jae                 7
            //   83c304               | add                 ebx, 4
            //   eb0f                 | jmp                 0x11
            //   81fb00000001         | cmp                 ebx, 0x1000000

        $sequence_7 = { 7305 83c302 eb29 81fb00010000 }
            // n = 4, score = 300
            //   7305                 | jae                 7
            //   83c302               | add                 ebx, 2
            //   eb29                 | jmp                 0x2b
            //   81fb00010000         | cmp                 ebx, 0x100

        $sequence_8 = { 0f8539ffffff b8???????? 8d5001 8a08 }
            // n = 4, score = 300
            //   0f8539ffffff         | jne                 0xffffff3f
            //   b8????????           |                     
            //   8d5001               | lea                 edx, [eax + 1]
            //   8a08                 | mov                 cl, byte ptr [eax]

        $sequence_9 = { 3d2cc00000 7f18 3d2bc00000 7d1b 3d9c000000 }
            // n = 5, score = 300
            //   3d2cc00000           | cmp                 eax, 0xc02c
            //   7f18                 | jg                  0x1a
            //   3d2bc00000           | cmp                 eax, 0xc02b
            //   7d1b                 | jge                 0x1d
            //   3d9c000000           | cmp                 eax, 0x9c

        $sequence_10 = { 763a b801011000 f7e6 8bc6 2bc2 d1e8 }
            // n = 6, score = 300
            //   763a                 | jbe                 0x3c
            //   b801011000           | mov                 eax, 0x100101
            //   f7e6                 | mul                 esi
            //   8bc6                 | mov                 eax, esi
            //   2bc2                 | sub                 eax, edx
            //   d1e8                 | shr                 eax, 1

        $sequence_11 = { 0f84bf000000 6803010000 8895f0fcffff 8d95f1fcffff 6a00 52 e8???????? }
            // n = 7, score = 300
            //   0f84bf000000         | je                  0xc5
            //   6803010000           | push                0x103
            //   8895f0fcffff         | mov                 byte ptr [ebp - 0x310], dl
            //   8d95f1fcffff         | lea                 edx, [ebp - 0x30f]
            //   6a00                 | push                0
            //   52                   | push                edx
            //   e8????????           |                     

        $sequence_12 = { 50 e8???????? 8d8f0e010000 8bc1 83c430 8d5001 }
            // n = 6, score = 300
            //   50                   | push                eax
            //   e8????????           |                     
            //   8d8f0e010000         | lea                 ecx, [edi + 0x10e]
            //   8bc1                 | mov                 eax, ecx
            //   83c430               | add                 esp, 0x30
            //   8d5001               | lea                 edx, [eax + 1]

        $sequence_13 = { 02ca 8b55f4 880c3e 0fb6540205 }
            // n = 4, score = 300
            //   02ca                 | add                 cl, dl
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   880c3e               | mov                 byte ptr [esi + edi], cl
            //   0fb6540205           | movzx               edx, byte ptr [edx + eax + 5]

        $sequence_14 = { 50 e8???????? b9???????? 83c424 }
            // n = 4, score = 300
            //   50                   | push                eax
            //   e8????????           |                     
            //   b9????????           |                     
            //   83c424               | add                 esp, 0x24

        $sequence_15 = { 50 6a02 51 ff15???????? 83f801 }
            // n = 5, score = 300
            //   50                   | push                eax
            //   6a02                 | push                2
            //   51                   | push                ecx
            //   ff15????????         |                     
            //   83f801               | cmp                 eax, 1

    condition:
        7 of them and filesize < 1064960
}
Download all Yara Rules