SEKOIA_Apt_Andariel_Nestdoor_Variants_Strings

rule SEKOIA_Apt_Andariel_Nestdoor_Variants_Strings : FILE
{
	meta:
		description = "Detects Nestdoor based on (weak) strings"
		author = "Sekoia.io"
		id = "dcfc48ad-f17b-4224-912b-b01740080fea"
		date = "2024-06-17"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_andariel_nestdoor_variants_strings.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "bc01138d1fc079c2b778175742e121f10cb47f29cc4eb04d38b4f0f5740f05a4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$v_11 = "Error occurs while reading" wide
		$v_12 = "{DECIMAL}" wide
		$v_13 = "lnk_" wide
		$v_21 = "Cannot connect with your ip and your operating system." wide
		$v_22 = "del /q /f %1" ascii
		$v_23 = "/f /tn %2" ascii

	condition:
		( uint32be( 0 ) == 0x7f454c46 or uint16be( 0 ) == 0x4d5a ) and ( all of ( $v_1* ) or all of ( $v_2* ) )
}