SEKOIA_Apt_Lazarus_Lambload_Timecheck

rule SEKOIA_Apt_Lazarus_Lambload_Timecheck : FILE
{
	meta:
		description = "Detects timeCheck routine in LambLoad"
		author = "Sekoia.io"
		id = "8807c752-c34e-4c3b-9194-3a9bd2575a88"
		date = "2023-11-27"
		modified = "2024-12-19"
		reference = "https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_lazarus_lambload_timecheck.yar#L1-L67"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "019e559f3596cf83f7e7ada05f6550b50b2d45d577600fa549470b98af93e23b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$chunk_1 = {
        0F 85 ?? ?? ?? ??
        8D 85 ?? ?? ?? ??
        50
        E8 ?? ?? ?? ??
        83 C4 ??
        83 78 ?? ??
        0F 85 ?? ?? ?? ??
        8B 48 ??
        83 F9 ??
        0F 8C ?? ?? ?? ??
        83 F9 ??
        0F 8D ?? ?? ?? ??
        8B 40 ??
        83 F8 ??
        0F 8C ?? ?? ?? ??
        83 F8 ??
        0F 8D ?? ?? ?? ??
        53
        57
        68 ?? ?? ?? ??
        8D 85 ?? ?? ?? ??
        6A ??
        50
        C7 85 ?? ?? ?? ?? ?? ?? ?? ??
        }

	condition:
		uint16be( 0 ) == 0x4d5a and any of them
}