BLACKBERRY_Mal_Infostealer_MSI_Jupyter_Embedded_Powershell

rule BLACKBERRY_Mal_Infostealer_MSI_Jupyter_Embedded_Powershell : FILE
{
	meta:
		description = "Detects Jupter by a specific PowerShell command present in the MSI Installer"
		author = "BlackBerry Threat Research Team"
		id = "feee2c1d-b6c5-5a79-a409-c2add83dc68f"
		date = "2021-10-14"
		modified = "2022-07-06"
		reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_MSI_Jupyter_Embedded_PowerShell.yar#L1-L20"
		license_url = "N/A"
		logic_hash = "7528342e5aea1c35b59a458695c0e363c6d6c6e1c2df38614ff185c74085ac89"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

	strings:
		$msi = { D0 CF 11 E0 A1 B1 1A E1 }
		$x1 = /powershell-ep bypass -windowstyle hidden -command \"\$xp=\'\[AppDataFolder\]pd\w*\.(log|txt)\';\$xk=\'[a-zA-Z]{52}\';\$xb=\[\\\[\]System\.Convert\[\\\]\]::FromBase64String\(\[\\\[\]System\.IO\.File\[\\\]\]::ReadAllText\(\$xp\)\);remove-item \$xp;for\(\$i=0;\$i -lt \$xb.count;\)\[\\\{\]for\(\$j=0;\$j -lt \$xk\.length;\$j\+\+\)\[\\\{\]\$xb\[\\\[\]\$i\[\\\]\]=\$xb\[\\\[\]\$i\[\\\]\] -bxor \$xk\[\\\[\]\$j\[\\\]\];\$i\+\+;if\(\$i -ge \$xb.count\)\[\\\{\]\$j=\$xk\.length;\[\\\}\]\[\\\}\]\[\\\}\];\$xb=\[\\\[\]System.Text.Encoding\[\\\]\]::UTF8\.GetString\(\$xb\);iex \$xb;/ nocase

	condition:
		$msi at 0 and all of ( $x* )
}