SEKOIA_Crypter_Win_Dotrunpex

rule SEKOIA_Crypter_Win_Dotrunpex : FILE
{
	meta:
		description = "Detect the dotRunpeX crypter based on strings"
		author = "Sekoia.io"
		id = "6fb4ffe0-3a5c-432c-8ae2-404bb5960c30"
		date = "2023-06-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/crypter_win_dotrunpex.yar#L1-L15"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "8a2b9e19b49ba17f976241bec5323121ba13d2ce39fdcf2777fd97a230211e75"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = {52 00 75 00 6e 00 70 00 65 00 58 00 2e 00 53 00 74 00 75 00 62 00 2e 00 46 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 2e 00 65 00 78 00 65}

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}