TRELLIX_ARC_Cyaxsharp_Rezer0

rule TRELLIX_ARC_Cyaxsharp_Rezer0 : LOADER
{
	meta:
		description = "Detects CyaX-Sharp/ReZer0 loader samples based on the embedded scheduled task template"
		author = "Max 'Libra' Kersten for McAfee's Advanced Threat Research Team"
		id = "7a1addcf-4e8f-5290-8788-9b0738128160"
		date = "2021-04-08"
		modified = "2021-08-04"
		reference = "This rule was published in combination with the following McAfee ATR blog: https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/see-ya-sharp-a-loaders-tale/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MAL_cyax_sharp_loader.yar#L1-L16"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "3d6daaf7a85a9b3898e4ce5d5293b09f26965f9f7280b34ba8f6814b7f14dec2"
		score = 75
		quality = 70
		tags = "LOADER"
		version = "1.0"
		malware_type = "loader"

	strings:
		$template = { 01A10C3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3136223F3E0D0A3C5461736B2076657273696F6E3D22312E322220786D6C6E733D22687474703A2F2F736368656D61732E6D6963726F736F66742E636F6D2F77696E646F77732F323030342F30322F6D69742F7461736B223E0D0A20203C526567697374726174696F6E496E666F3E0D0A202020203C446174653E323031342D31302D32355431343A32373A34342E383932393032373C2F446174653E0D0A202020203C417574686F723E5B5553455249445D3C2F417574686F723E0D0A20203C2F526567697374726174696F6E496E666F3E0D0A20203C54726967676572733E0D0A202020203C4C6F676F6E547269676765723E0D0A2020202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A202020203C2F4C6F676F6E547269676765723E0D0A202020203C526567697374726174696F6E547269676765723E0D0A2020202020203C456E61626C65643E66616C73653C2F456E61626C65643E0D0A202020203C2F526567697374726174696F6E547269676765723E0D0A20203C2F54726967676572733E0D0A20203C5072696E636970616C733E0D0A202020203C5072696E636970616C2069643D22417574686F72223E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A2020202020203C4C6F676F6E547970653E496E746572616374697665546F6B656E3C2F4C6F676F6E547970653E0D0A2020202020203C52756E4C6576656C3E4C6561737450726976696C6567653C2F52756E4C6576656C3E0D0A202020203C2F5072696E636970616C3E0D0A20203C2F5072696E636970616C733E0D0A20203C53657474696E67733E0D0A202020203C4D756C7469706C65496E7374616E636573506F6C6963793E53746F704578697374696E673C2F4D756C7469706C65496E7374616E636573506F6C6963793E0D0A202020203C446973616C6C6F77537461727449664F6E4261747465726965733E66616C73653C2F446973616C6C6F77537461727449664F6E4261747465726965733E0D0A202020203C53746F704966476F696E674F6E4261747465726965733E747275653C2F53746F704966476F696E674F6E4261747465726965733E0D0A202020203C416C6C6F77486172645465726D696E6174653E66616C73653C2F416C6C6F77486172645465726D696E6174653E0D0A202020203C53746172745768656E417661696C61626C653E747275653C2F53746172745768656E417661696C61626C653E0D0A202020203C52756E4F6E6C7949664E6574776F726B417661696C61626C653E66616C73653C2F52756E4F6E6C7949664E6574776F726B417661696C61626C653E0D0A202020203C49646C6553657474696E67733E0D0A2020202020203C53746F704F6E49646C65456E643E747275653C2F53746F704F6E49646C65456E643E0D0A2020202020203C526573746172744F6E49646C653E66616C73653C2F526573746172744F6E49646C653E0D0A202020203C2F49646C6553657474696E67733E0D0A202020203C416C6C6F7753746172744F6E44656D616E643E747275653C2F416C6C6F7753746172744F6E44656D616E643E0D0A202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A202020203C48696464656E3E66616C73653C2F48696464656E3E0D0A202020203C52756E4F6E6C79496649646C653E66616C73653C2F52756E4F6E6C79496649646C653E0D0A202020203C57616B65546F52756E3E66616C73653C2F57616B65546F52756E3E0D0A202020203C457865637574696F6E54696D654C696D69743E505430533C2F457865637574696F6E54696D654C696D69743E0D0A202020203C5072696F726974793E373C2F5072696F726974793E0D0A20203C2F53657474696E67733E0D0A20203C416374696F6E7320436F6E746578743D22417574686F72223E0D0A202020203C457865633E0D0A2020202020203C436F6D6D616E643E5B4C4F434154494F4E5D3C2F436F6D6D616E643E0D0A202020203C2F457865633E0D0A20203C2F416374696F6E733E0D0A3C2F5461736B3E }

	condition:
		$template
}