DITEKSHEN_MALWARE_Win_Iceid

rule DITEKSHEN_MALWARE_Win_Iceid : FILE
{
	meta:
		description = "Detects IceID / Bokbot variants"
		author = "ditekSHen"
		id = "0da94737-0f82-5892-a0eb-f9f3c0a114cc"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5157-L5176"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "204b4c297806a36ca14bb3e659824f4eb49b18308af7090f0db1194705f1e2c9"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$n1 = "POST" fullword wide
		$n2 = "; _gat=" fullword wide
		$n3 = "; _ga=" fullword wide
		$n4 = "; _u=" fullword wide
		$n5 = "; __io=" fullword wide
		$n6 = "; _gid=" fullword wide
		$n7 = "Cookie: __gads=" fullword wide
		$s1 = "c:\\ProgramData" ascii
		$s2 = "loader_dll_64.dll" fullword ascii
		$s3 = "loader_dll_32.dll" fullword ascii
		$s4 = "/?id=%0.2X%0.8X%0.8X%s" ascii
		$s5 = "%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.8X" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $n* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $n* ) ) )
}