DITEKSHEN_MALWARE_Win_Blacknet

rule DITEKSHEN_MALWARE_Win_Blacknet : FILE
{
	meta:
		description = "Detects BlackNET RAT"
		author = "ditekSHen"
		id = "c1ece46a-3cd9-54aa-a105-1c5b19357a7e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2222-L2250"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "64e00325a5a6a595067c6133800e73d943f45e2783475c24ed4a9bd9937fe0d6"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920079-920082"
		snort3_sid = "920079-920082"
		clamav_sig = "MALWARE.Win.Trojan.BlackNET"

	strings:
		$s1 = "SbieCtrl" fullword wide
		$s2 = "SpyTheSpy" fullword wide
		$s3 = "\\BlackNET.dat" fullword wide
		$s4 = "StartDDOS" fullword wide
		$s5 = "UDPAttack" fullword wide
		$s6 = "ARMEAttack" fullword wide
		$s7 = "TCPAttack" fullword wide
		$s8 = "HTTPGetAttack" fullword wide
		$s9 = "RetriveLogs" fullword wide
		$s10 = "StealPassword" fullword wide
		$s11 = "/create /f /sc ONSTART /RL HIGHEST /tn \"'" fullword wide
		$b1 = "DeleteScript|BN|" fullword wide
		$b2 = "|BN|Online" fullword wide
		$b3 = "NewLog|BN|" fullword wide
		$cnc1 = "/getCommand.php?id=" fullword wide
		$cnc2 = "/upload.php?id=" fullword wide
		$cnc3 = "connection.php?data=" fullword wide
		$cnc4 = "/receive.php?command=" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and ( 9 of ( $s* ) or all of ( $cnc* ) or all of ( $b* ) or 12 of them )
}