SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_1

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_1 : FILE
{
	meta:
		description = "Detects BoomBox malware as described in APT29 NOBELIUM report"
		author = "Florian Roth"
		id = "1a14dcf7-81be-5a74-a530-caf6268d1976"
		date = "2021-05-27"
		modified = "2025-03-20"
		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L130-L161"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
		logic_hash = "034ea34eb34ea6de0c65b9a7fc9d16f108ef34cd75294b022371ac17789c3830"
		score = 85
		quality = 85
		tags = "FILE"

	strings:
		$a1 = "]::FromBase64String($" ascii wide
		$xa1 = "123do3y4r378o5t34onf7t3o573tfo73" ascii wide fullword
		$xa2 = "1233t04p7jn3n4rg" ascii wide fullword
		$s1 = "\\Release\\BOOM.pdb" ascii
		$s2 = "/files/upload" ascii
		$s3 = "/tmp/readme.pdf" ascii fullword
		$s4 = "/new/{0}" ascii fullword
		$s5 = "(&(objectClass=user)(objectCategory=person))"

	condition:
		( uint16( 0 ) == 0x5a4d or 1 of ( $a* ) ) and ( 1 of ( $x* ) or 3 of ( $s* ) )
}