VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate

rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate : EVILBAMBOO FILE
{
	meta:
		description = "Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication."
		author = "threatintel@volexity.com"
		id = "5a033770-7ad3-5c79-90ac-b1e3fff6b5f0"
		date = "2023-06-01"
		modified = "2023-06-13"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L230-L255"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "6aefc2b33e23f6e3c96de51d07f7123bd23ff951d67849a9bd32d446e76fb405"
		logic_hash = "861d4e1c40847c6ade04eddb047370d645afea6d5c16d55155fa58a16111c39e"
		score = 75
		quality = 80
		tags = "EVILBAMBOO, FILE"
		scan_context = "file"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"

	strings:
		$b1 = {30 82 03 61 30 82 02 49 a0 03 02 01 02 02 04 2b 6e df 67 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b}
		$s1 = "california1"
		$s2 = "los1"
		$s3 = "tech1"
		$s4 = "common1"
		$s5 = "common0"
		$s6 = "220401234506Z"
		$s7 = "470326234506Z0a1"

	condition:
		$b1 at 0 or all of ( $s* )
}