SEKOIA_Implant_Win_Flagpro

rule SEKOIA_Implant_Win_Flagpro : FILE
{
	meta:
		description = "Detect the Flagpro malware used by Blacktech"
		author = "Sekoia.io"
		id = "08dd2de4-b359-424f-af04-7f294d519363"
		date = "2022-04-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/implant_win_flagpro.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "eb1aba9924af474d6d890572a9bf72e0d1aa5dc31dd4cc34648195b0207ab4d6"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "<BODY ID=CV20_LoaderDlg BGCOLOR=LIGHTGREY style=\"font-family:MS Shell Dlg;font-size:8\">" ascii
		$ = "<TABLE WIDTH=100% HEIGHT=100%>" ascii
		$ = "<TR WIDTH=100% HEIGHT=45%>" ascii
		$ = "<TD ALIGN=CENTER VALIGN=BOTTOM>" ascii
		$ = "TODO: Place controls here." ascii
		$ = "<TD ALIGN=RIGHT VALIGN=BOTTOM>" ascii
		$ = "<BUTTON STYLE=\"WIDTH:100\" ID=\"ButtonHelp\">Help</BUTTON>&nbsp;&nbsp;<BUTTON STYLE=\"WIDTH:100\" ID=\"ButtonOK\">OK</BUTTON>&nbsp;<BUTTON STYLE=\"WIDTH:100\" ID=\"ButtonCancel\">Cancel</BUTTON>" ascii
		$about_loader = /About V[0-9]+\.[0-9]+_Loader.../ wide
		$path = "f:\\dd\\vctools\\vc7libs\\ship\\atlmfc\\include\\" wide
		$regitry = "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\" wide

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}