VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf : TRANSPARENTJASMINE FILE
{
	meta:
		description = "Detects a script deployed as part of DISGOMOJI malware chain."
		author = "threatintel@volexity.com"
		id = "b338b3cf-22ce-5767-bdea-503e883bc84b"
		date = "2024-03-07"
		modified = "2024-07-05"
		reference = "TIB-20240318"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L188-L215"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef"
		logic_hash = "2a19d5cff7adc9b1b92538a5df4e3cadea694f925f65080f5093fc5425e840f4"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE"
		os = "linux"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10312
		version = 7

	strings:
		$s1 = "add_lan_conf_cron_if_not_exists" wide ascii
		$s2 = "download_if_not_exists" wide ascii
		$s3 = "add_cron_if_not_exists" wide ascii
		$s4 = "uevent_seqnum.sh" wide ascii
		$s5 = "$HOME/.x86_64-linux-gnu" wide ascii
		$s6 = "lanConfScriptPath" wide ascii

	condition:
		4 of them
}