SEKOIA_Backdoor_Win_Minibus

import "pe"
import "hash"

rule SEKOIA_Backdoor_Win_Minibus : FILE
{
	meta:
		description = "Detect the MINIBUS backdoor used by UNC1549 since August 2023"
		author = "Sekoia.io"
		id = "f88bcf15-9a9f-4d84-adc6-db1db55fe93c"
		date = "2024-02-29"
		modified = "2024-12-19"
		reference = "https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/backdoor_win_minibus.yar#L4-L41"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "57dabcc15c84c4497b3561f19a7e464fb0dfe93576f4caea88c7cd8534cb4bfd"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$dll_150_1 = "TorvaldsPersist.dll"
		$dll_150_2 = "FileCoAuth.exe"
		$dll_50_1 = "TorvaldInitial.dll"
		$dll_50_2 = "\\essential.dat"

	condition:
		( uint16( 0 ) == 0x5A4D and all of ( $dll_150_* ) or for any i in ( 0 .. pe.number_of_resources -1 ) : ( hash.sha256 ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) == "2cf9797b1cfb5795d0fb892b7c371d506a5dd8b7c64fdc82975b3fde6d997df0" ) ) or ( uint16( 0 ) == 0x5A4D and all of ( $dll_50_* ) or for any i in ( 0 .. pe.number_of_resources -1 ) : ( hash.sha256 ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) == "de3fb5d4419eb6b943872dd6e3dd93d19584ef2b158aa3158b3b09f0a9b628ef" ) )
}