BLACKBERRY_Windealer_Executable

rule BLACKBERRY_Windealer_Executable : FILE
{
	meta:
		description = "Detects WinDealer Executable"
		author = "BlackBerry Threat Research Team"
		id = "68fe2b61-5c2d-5434-a9c5-dae25ccd40a0"
		date = "2022-06-14"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malwareZ"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Windealer_executable.yar#L1-L23"
		license_url = "N/A"
		logic_hash = "296e89ca89d063d165b6abab6a1e1e0b641cbbe7ff0ea60125c6beada457a95b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

	strings:
		$s1 = "28e4-20a6acec"
		$s2 = "5a7e-42ccdb67"
		$s3 = "632c-0ef22957"
		$s4 = "63ae-a20cf808"
		$s5 = "65ce-731bffbb"
		$a1 = "remoteip"
		$a2 = "sessionid"
		$a3 = "remotedomain"
		$a4 = "remark"

	condition:
		uint16( 0 ) == 0x5a4d and 2 of ( $s* ) and 1 of ( $a* )
}