SEKOIA_Loader_Win_Abcloader

import "pe"
import "hash"

rule SEKOIA_Loader_Win_Abcloader : FILE
{
	meta:
		description = "Detect ABCloader"
		author = "Sekoia.io"
		id = "c286ce75-a041-478e-a567-4bf1d5e66c01"
		date = "2024-08-19"
		modified = "2024-12-19"
		reference = "https://nsfocusglobal.com/new-apt-group-actor240524-a-closer-look-at-its-cyber-tactics-against-azerbaijan-and-israel/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_win_abcloader.yar#L4-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "0d1dca5eaad49c2dbd979e1bf0b5f8d0"
		hash = "9a640889e82407b06c546fea15be668f"
		logic_hash = "64d171d31c2f03ac18dde61d5b57fba91448045404b0ff619fb8cd437a561b1f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "qSii.LI4"
		$ = "Cabinet.dll"

	condition:
		uint16be( 0 ) == 0x4d5a and all of them or pe.imphash ( ) == "45c6b272631aa9e0c4b2ba675699b803" or hash.md5 ( pe.rich_signature.clear_data ) == "b33158757dc039859e272f4528e10e80"
}