DITEKSHEN_MALWARE_Win_Fpspy

import "pe"

rule DITEKSHEN_MALWARE_Win_Fpspy : FILE
{
	meta:
		description = "FPSpy"
		author = "ditekshen"
		id = "39d3be12-1b06-57b1-b3c2-2cbd13a17b03"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11887-L11916"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c26736c7f056f3d13c58e724fda601e88468e2386852b072a37c6646fb5ef8f9"
		score = 75
		quality = 73
		tags = "FILE"
		clamav1 = "MALWARE.Win.Trojan.FPSpy"

	strings:
		$f1 = "[Analys_Spy]" wide
		$f2 = "[DeletePoorDll]" wide
		$f3 = "[DownloadProc]" wide
		$f4 = "[DragWarp]" wide
		$f5 = "[GetCoolDir]" wide
		$f6 = "[JackSleep]" wide
		$f7 = "[KillCmdExe]" wide
		$f8 = "[PsDownProc]" wide
		$f9 = "[PsUpProc]" wide
		$f10 = "[ReadFileFromPacket]" wide
		$f11 = "[RemoteDropExec]" wide
		$f12 = "[RemoteExec]" wide
		$f13 = "[RemoteInject]" wide
		$f14 = "[SendHttpForUpload]" wide
		$s1 = "MazeFunc" fullword ascii
		$s2 = /(Exit|Update|Drop)_EVT/ fullword ascii
		$s3 = "Key.dat" fullword ascii
		$s4 = "%sSysInfo_%02d_%02d_%02d.txt" fullword ascii
		$s5 = "cmd /c systeminfo >> %s" fullword ascii
		$s6 = "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"" fullword ascii
		$s7 = "FPSpy" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and ( ( pe.exports ( "MazeFunc" ) and 2 of ( $f* ) and 1 of ( $s* ) ) or ( 6 of ( $f* ) and 1 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $f* ) ) or ( 8 of ( $f* ) ) )
}