SEKOIA_Malware_Valleyrat_Strings_Config

rule SEKOIA_Malware_Valleyrat_Strings_Config : FILE
{
	meta:
		description = "ValleyRAT strings based on HIVE KEYS and config. "
		author = "Sekoia.io"
		id = "bb186ab7-60cd-487e-8b9c-c2ff8f121454"
		date = "2024-08-19"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/malware_valleyrat_strings_config.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "b1887a48e59ac7b1b1742854d2a228af"
		hash = "f6c69e83ce61aacacfbc410345008268"
		hash = "63ad42e03aca6ce447fb447e21aeb385"
		hash = "e1d41e5fdfebf8062911ef3c3853b807"
		hash = "e6cafb4136a9438227086a5826eafe10"
		hash = "54ba4bbeacd1521164a40e92262b15f6"
		logic_hash = "89a3d3ca32f9c57e932686f0ed03821350770f82e598948ed86414e231e27a30"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$key1 = "IpDateInfo" ascii fullword
		$key2 = "IpDate" ascii fullword
		$key3 = "SelfPath" ascii fullword
		$config1 = {7c 00 69 00 3a 00 }
		$config2 = {7c 00 70 00 3a 00 }

	condition:
		uint16be( 0 ) == 0x4d5a and 1 of ( $key* ) and $config2 in ( @config1 .. @config1 + 100 ) and filesize > 300KB and filesize < 100MB
}