SIGNATURE_BASE_MAL_Sindoor_Downloader_Aug25

rule SIGNATURE_BASE_MAL_Sindoor_Downloader_Aug25 : FILE
{
	meta:
		description = "Detects Sindoor downloader related to APT 36"
		author = "Pezier Pierre-Henri"
		id = "c1188abc-2bea-5cbc-a39d-9690626c0821"
		date = "2025-08-29"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt36_operation_sindoor.yar#L65-L90"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4"
		logic_hash = "c55be65cd077cb04b625636dffcb02af74efa06bb49da734c8616da233a34d1a"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "Go build"
		$s2 = "main.downloadFile.deferwrap"
		$s3 = "main.decrypt"
		$s4 = "main.HiddenHome"
		$s5 = "main.RealCheck"

	condition:
		filesize < 100MB and ( uint16( 0 ) == 0x5a4d or uint32be( 0 ) == 0x7f454c46 or ( uint32be( 0 ) == 0xcafebabe and uint32be( 4 ) < 0x20 ) or uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xfeedfacf ) and all of them
}