DITEKSHEN_MALWARE_Win_Bluebot

rule DITEKSHEN_MALWARE_Win_Bluebot : FILE
{
	meta:
		description = "Detects BlueBot"
		author = "ditekSHen"
		id = "cddd40bb-c3c6-5c44-9cb1-480571375be8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7306-L7333"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "04a19f649eb2fff7a5bc59ccead80cd0a04c4e5418cbc83e850045dba75b03e0"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$x1 = "Blue_Botnet" wide
		$x2 = "5-START-http" ascii
		$x3 = "*300-END-" ascii
		$x4 = "botlogger.php" wide
		$s1 = "//TARGET//" wide
		$s2 = "//BLOG//" wide
		$s3 = "MCBOTALPHA" wide
		$s4 = "//IPLIST//" wide
		$s5 = "Host: //BLOG//" wide
		$s6 = "User-Agent: //USERAGENT//" wide
		$s7 = "<string>//TARGET//</string>" wide
		$s8 = "POST //URL// HTTP/1.1/r/n" wide
		$v1 = "<attack>b__" ascii
		$v2 = "PressData" fullword ascii
		$v3 = "POSTPiece" fullword ascii
		$v4 = /(load|tcp|udp)Stuff/ fullword ascii
		$v5 = "isAttacking" fullword ascii
		$v6 = "DoSAttack" fullword ascii
		$v7 = "prv_attack" fullword ascii
		$v8 = "blogList" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 5 of ( $s* ) or 5 of ( $v* ) or 9 of them )
}