SEKOIA_Apt_Apt28_Susp_Graphite_Downloader

import "pe"

rule SEKOIA_Apt_Apt28_Susp_Graphite_Downloader : FILE
{
	meta:
		description = "Matches the routine which decrypts the RSA key blob in the Graphite downloader"
		author = "Sekoia.io"
		id = "9c9da5fe-ffd6-4c45-8ce1-9a6cf4fa2fda"
		date = "2022-01-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_apt28_susp_graphite_downloader.yar#L3-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "ca5aa7ea995aca9003fd98da2fba7bbec1e049d979a6b05e07b80876bab5a1c9"
		score = 65
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$gen = { 33 D2
        8B C1
        6A ??
        5E
        F7 F6
        8A 82 ?? ?? ?? ??
        30 81 ?? ?? ?? ??
        41
        81 F9 94 04 00 00
        72 E2 }

	condition:
		uint16be( 0 ) == 0x4d5a and $gen and pe.number_of_exports == 1
}