Detects sample mentioned in the Dubnium Report

Hunt Hypothesis

The hypothesis is that the detected sample aligns with the Dubnium Report’s identified malicious activity, indicating potential adversarial use of known malicious code. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage threats linked to this specific malware family.

YARA Rule

rule Dubnium_Sample_7
{

    meta:
        description = "Detects sample mentioned in the Dubnium Report"
        author = "Florian Roth"
        reference = "https://goo.gl/AW9Cuu"
        date = "2016-06-10"
        super_rule = 1
        hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
        hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
        hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
        hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
        hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
        hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
        hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
        hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"

    strings:
        $s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
        $s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 9000KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Scenario: A system administrator is performing a scheduled backup using Veeam Backup & Replication and the backup process includes a file that matches the hash from the Dubnium Report.
Filter/Exclusion: Exclude files associated with Veeam Backup & Replication or files with the “backup” keyword in their path.
Scenario: A security analyst is manually analyzing a sample using Wireshark and the file being examined is a known benign sample from the Dubnium Report.
Filter/Exclusion: Exclude files opened via Wireshark or files with the “analysis” or “manual” keyword in their context.
Scenario: A system update job using Windows Server Update Services (WSUS) includes a file that matches the Dubnium Report hash due to a misconfigured update package.
Filter/Exclusion: Exclude files related to WSUS or files with the “update” or “patch” keyword in their filename.
Scenario: A DevOps team is running a CI/CD pipeline using Jenkins and a build artifact matches the hash from the Dubnium Report due to a mislabeled file.
Filter/Exclusion: Exclude files with the “jenkins” or “build” keyword in their path, or files generated by Jenkins pipelines.
Scenario: A database administrator is exporting a database using MySQL and the exported file contains a hash that matches the Dubnium Report due to a data export process.
Filter/Exclusion: Exclude files generated by MySQL or files with the “export” or “backup” keyword in their name.