DITEKSHEN_MALWARE_Win_Vanillarat

rule DITEKSHEN_MALWARE_Win_Vanillarat : FILE
{
	meta:
		description = "Detects VanillaRAT"
		author = "ditekSHen"
		id = "70c2cd1a-a6d4-562e-a6fc-c16a9e87c6b7"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7882-L7902"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d7b90ac88a50693ec4bb0676c04f5d161f04f67970ea60d80e79d774da75bfdc"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$stub = "VanillaStub." ascii wide
		$s1 = "Client.Send: " wide
		$s2 = "Connected to chat" fullword wide
		$s3 = "GetStoredPasswords" fullword wide
		$s4 = "Started screen locker." fullword wide
		$s5 = "[<\\MOUSE>]" fullword wide
		$s6 = "YOUR SCREEN HAS BEEN LOCKED!" fullword wide
		$s7 = "record recsound" fullword wide
		$f1 = "<StartRemoteDestkop>d__" ascii
		$f2 = "<ConnectLoop>d__" ascii
		$f3 = "<Scan0>k__" ascii
		$f4 = "<RemoteShellActive>k__" ascii
		$f5 = "KillClient" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( $stub and ( 2 of ( $s* ) or 2 of ( $f* ) ) ) or 6 of ( $s* ) or all of ( $f* ) )
}