SEKOIA_Loader_Win_Ninerat

import "pe"
import "hash"

rule SEKOIA_Loader_Win_Ninerat
{
	meta:
		description = "Detect the NineRAT instrumentator"
		author = "Sekoia.io"
		id = "b9aa3ddc-7892-402f-b045-182884ee9bad"
		date = "2023-12-12"
		modified = "2024-12-19"
		reference = "https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_win_ninerat.yar#L4-L37"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "ba8cd92cc059232203bcadee260ddbae273fc4c89b18424974955607476982c4"
		hash = "5b02fc3cfb5d74c09cab724b5b54c53a7c07e5766bffe5b1adf782c9e86a8541"
		logic_hash = "eab81277a2ffe926c2d9f990ee2e36f0e5f27a14d3048c50d31952d90ce7ab0b"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "TelegramRat\\lastest\\Dropper"
		$ = "\\Release\\ServiceMid.pdb"

	condition:
		all of them or pe.imphash ( ) == "104a3dc970a385f64de39e0dad61a9a2" or hash.md5 ( pe.rich_signature.clear_data ) == "aab0aa6b89d883e42be8b65a4e41a139" or for any i in ( 0 .. pe.number_of_sections -1 ) : ( hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "827d5fd4b1a0426037529ee9bba48da0" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "82354f92508dcb33acda01c226de2975" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "ccd0f5d837a6cc05a861f040cbdfe080" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "8d2c169356afe8b53b0ecb83de3084b9" )
}