LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_082A

rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_082A
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious."
		author = "Florian Roth"
		id = "bfb3b8e6-a13d-5fcc-a8e9-d0e012577c82"
		date = "2026-04-28"
		modified = "2026-09-08"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9fa32adeab865455de8b24cba0bbc0f3439d59f7/detections/yara/yara-rules_mal_drivers.yar#L324-L382"
		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9fa32adeab865455de8b24cba0bbc0f3439d59f7/LICENSE"
		hash = "082a79311da64b6adc3655e79aa090a9262acaac3b917a363b9571f520a17f6a"
		hash = "083f821d90e607ed93221e71d4742673e74f573d0755a96ad17d1403f65a2254"
		hash = "0f98492c92e35042b09032e3d9aedc357e4df94fc840217fa1091046f9248a06"
		hash = "10ad50fcb360dcab8539ea322aaf2270565dc835b7535790937348523d723d6b"
		hash = "12b0000698b79ea3c8178b9e87801cc34bad096a151a8779559519deafd4e3f0"
		hash = "19dfacea1b9f19c0379f89b2424ceb028f2ce59b0db991ba83ae460027584987"
		hash = "1a5c08d40a5e73b9fe63ea5761eaec8f41d916ca3da2acbc4e6e799b06af5524"
		hash = "2456a7921fa8ab7b9779e5665e6b42fccc019feb9e49a9a28a33ec0a4bb323c4"
		hash = "3ca5d47d076e99c312578ef6499e1fa7b9db88551cfc0f138da11105aca7c5e1"
		hash = "4136f1eb11cc463a858393ea733d5f1c220a3187537626f7f5d63eccf7c5a03f"
		hash = "492113a223d6a3fc110059fe46a180d82bb8e002ef2cd76cbf0c1d1eb8243263"
		hash = "4b97d63ebdeda6941bb8cef5e94741c6cca75237ca830561f2262034805f0919"
		hash = "4c89c907b7525b39409af1ad11cc7d2400263601edafc41c935715ef5bd145de"
		hash = "4d42678df3917c37f44a1506307f1677b9a689efcf350b1acce7e6f64b514905"
		hash = "569fe70bedd0df8585689b0e88ad8bd0544fdf88b9dbfc2076f4bdbcf89c28aa"
		hash = "793b78e70b3ae3bb400c5a8bc4d2d89183f1d7fc70954aed43df7287248b6875"
		hash = "7b846b0a717665e4d9fb313f25d1f6a5b782e495387aea45cf87ad3c049ac0db"
		hash = "80e4c83cfa9d675a6746ab846fa5da76d79e87a9297e94e595a2d781e02673b3"
		hash = "85b9d7344bf847349b5d58ebe4d44fd63679a36164505271593ef1076aa163b2"
		hash = "93aa3066ae831cdf81505e1bc5035227dc0e8f06ebbbb777832a17920c6a02fe"
		hash = "94c71954ac0b1fd9fa2bd5c506a16302100ba75d9f84f39ee9b333546c714601"
		hash = "95e5b5500e63c31c6561161a82f7f9373f99b5b1f54b018c4866df4f2a879167"
		hash = "a0931e16cf7b18d15579e36e0a69edad1717b07527b5407f2c105a2f554224b2"
		hash = "a1e6b431534258954db07039117b3159e889c6b9e757329bbd4126383c60c778"
		hash = "aaf04d89fd15bc61265e545f8e1da80e20f59f90058ed343c62ee24358e3af9e"
		hash = "ac5fb90e88d8870cd5569e661bea98cf6b001d83ab7c65a5196ea3743146939a"
		hash = "b0b80a11802b4a8ca69c818a03e76e7ef57c2e293de456439401e8e6073f8719"
		hash = "bc49cb96f3136c3e552bf29f808883abb9e651040415484c1736261b52756908"
		hash = "c42c1e5c3c04163bf61c3b86b04a5ec7d302af7e254990cef359ac80474299da"
		hash = "cf9451c9ccc5509b9912965f79c2b95eb89d805b2a186d7521d3a262cf5a7a37"
		hash = "d032001eab6cad4fbef19aab418650ded00152143bd14507e17d62748297c23f"
		hash = "d37996abc8efb29f1ccbb4335ce9ba9158bec86cc4775f0177112e87e4e3be5c"
		hash = "d43520128871c83b904f3136542ea46644ac81a62d51ae9d3c3a3f32405aad96"
		hash = "e8ec06b1fa780f577ff0e8c713e0fd9688a48e0329c8188320f9eb62dfc0667f"
		hash = "e99580e25f419b5ad90669e0c274cf63d30efa08065d064a863e655bdf77fb59"
		hash = "ee525b90053bb30908b5d7bf4c5e9b8b9d6b7b5c9091a26fa25d30d3ad8ef5d0"
		hash = "ee7b8eb150df2788bb9d5fe468327899d9f60d6731c379fd75143730a83b1c55"
		hash = "efa56907b9d0ec4430a5d581f490b6b9052b1e979da4dab6a110ab92e17d4576"
		hash = "f03f0fb3a26bb83e8f8fa426744cf06f2e6e29f5220663b1d64265952b8de1a1"
		hash = "f9b01406864ab081aa77eef4ad15cb2dd2f830d1ef54f52622a59ff1aeb05ba5"
		logic_hash = "9cc08eead20733d15cc302f9c61b4a7b48682063b9a7ce48b2b210da648d8c81"
		score = 70
		quality = 80
		tags = ""

	strings:
		$ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 }
		$ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 }
		$ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0032002e0030002e003000 }
		$ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0032002e0030002e003000 }
		$ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 }
		$ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 }
		$ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 }
		$ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000320030002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 }

	condition:
		all of them
}