Memory string yara for Shifu/Shiz

Hunt Hypothesis

This detection rule identifies the presence of specific memory signatures associated with the Shifu and Shiz malware families, which are known to execute in-memory payloads within Azure environments. Proactively hunting for these indicators allows the SOC team to uncover stealthy infections that may evade traditional file-based scanning, ensuring early containment before lateral movement occurs.

YARA Rule

rule shifu_shiz {
	meta:
		description = "Memory string yara for Shifu/Shiz"
		author = "J from THL <j@techhelplist.com>"
		reference1 = "https://researchcenter.paloaltonetworks.com/2017/01/unit42-2016-updates-shifu-banking-trojan/"
		reference2 = "https://beta.virusbay.io/sample/browse/24a6dfaa98012a839658c143475a1e46"
    reference3 = "https://raw.githubusercontent.com/Neo23x0/signature-base/master/yara/crime_shifu_trojan.yar"
		date = "2018-03-16"
		maltype1 = "Banker"
		maltype2 = "Keylogger"
		maltype3 = "Stealer"
		filetype = "memory"

	strings:
		$aa = "auth_loginByPassword"	fullword ascii
		$ab = "back_command"	fullword ascii
		$ac = "back_custom1"	fullword ascii
		$ad = "GetClipboardData"	fullword ascii
		$ae = "iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe"	fullword ascii
		$af = "mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe"	fullword ascii
		$ag = "svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.exe"	fullword ascii
		$ah = "!inject"	fullword ascii
		$ai = "!deactivebc"	fullword ascii
		$aj = "!kill_os"	fullword ascii
		$ak = "!load"	fullword ascii
		$al = "!new_config"	fullword ascii
		$am = "!activebc"	fullword ascii
		$an = "keylog.txt"	fullword ascii
		$ao = "keys_path.txt"	fullword ascii
		$ap = "pass.log"	fullword ascii
		$aq = "passwords.txt"	fullword ascii
		$ar = "Content-Disposition: form-data; name=\"file\"; filename=\"report\""	fullword ascii
		$as = "Content-Disposition: form-data; name=\"pcname\""	fullword ascii
		$at = "botid=%s&ver="	fullword ascii
		$au = "action=auth&np=&login="	fullword ascii
		$av = "&ctl00%24MainMenu%24Login1%24UserName="	fullword ascii
		$aw = "&cvv="	fullword ascii
		$ax = "&cvv2="	fullword ascii
		$ay = "&domain="	fullword ascii
		$az = "LOGIN_AUTHORIZATION_CODE="	fullword ascii
		$ba = "name=%s&port=%u"	fullword ascii
		$bb = "PeekNamedPipe"	fullword ascii
		$bc = "[pst]"	fullword ascii
		$bd = "[ret]"	fullword ascii
		$be = "[tab]"	fullword ascii
		$bf = "[bks]"	fullword ascii
		$bg = "[del]"	fullword ascii
		$bh = "[ins]"	fullword ascii
		$bi = "&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d&cn="	fullword ascii

	condition:
		18 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 35 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Memory string yara for Shifu/Shiz detection rule, tailored for a legitimate enterprise environment:

• Scenario: Scheduled Antivirus or EDR Scanning Jobs

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently perform scheduled deep memory scans during off-hours. These scanners often load specific heuristic modules or signature libraries into the System or dedicated service process memory to analyze running applications. The “Shifu/Shiz” string may be embedded within a proprietary scanning engine module or a third-party plugin used by the AV vendor, triggering the rule when the scanner updates its in-memory signatures.
  • Suggested Filter/Exclusion: Create an exclusion for processes with known benign parent-child relationships, specifically targeting MsMpEng.exe (Microsoft Defender) or CmService.exe (CrowdStrike) when they spawn child processes named ShizScan or similar variants during the defined maintenance window (e.g., 02:00–04:00 local time).

• Scenario: Enterprise Desktop Support Tool Deployment

  • Context: IT Helpdesk teams often deploy remote support agents like BeyondTrust, TeamViewer, or LogMeIn. These tools utilize a “Shifu” (Master/Controller) and “Shiz” (Agent/Worker) architecture for session management. When an administrator initiates a remote troubleshooting session, the agent injects its control logic into the user’s desktop memory space (explorer.exe), causing the Yara rule to detect the embedded “Shifu/Shiz” strings as part of the legitimate connection handshake.
  • Suggested Filter/Exclusion: Exclude alerts where the process image path contains known support tool directories (e.g., C:\Program Files\BeyondTrust\, `C:\TeamViewer