VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_C2_Strings

rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_C2_Strings : BRAZENBAMBOO FILE MEMORY
{
	meta:
		description = "Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc."
		author = "threatintel@volexity.com"
		id = "a0af8fb7-13a3-54e8-8569-e8622fa80d89"
		date = "2024-02-15"
		modified = "2024-11-14"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2024/2024-11-15 BrazenBamboo/rules.yar#L288-L337"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "80c0cdb1db961c76de7e4efb6aced8a52cd0e34178660ef34c128be5f0d587df"
		logic_hash = "eeaaf6e16d4854a2279bd62596f75cb8b8ec1b05f3b050f5dac97254704b9005"
		score = 75
		quality = 78
		tags = "BRAZENBAMBOO, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10245
		version = 4

	strings:
		$s1 = "[WsClient][Error]:"
		$s2 = "[WsClient][Info]:"
		$s3 = "[WsClient]:WsClient"
		$s4 = "[WsClient][Info]:Ws"
		$s5 = "WsClient Worker Thread ID=%d"
		$s6 = "[LightWebClient]:"
		$s7 = "LightHttpGet err:%s"
		$s8 = "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.145 Safari/537.36"
		$s9 = "KvList Err:%s"
		$s10 = "dataMultiPart malloc err:%d"
		$ctrl1 = "CTRL_HEART_BEAT"
		$ctrl2 = "CTRL_NET_CONFIG"
		$ctrl3 = "CTRL_COMMAND_PLAN"
		$ctrl4 = "CTRL_MODIFY_NET_CONFIG"
		$ctrl5 = "CTRL_UPLOAD_PLUGIN_STATUS"
		$ctrl6 = "CTRL_PLUGIN_EXECUTE_COMMAND"
		$ctrl7 = "CTRL_PLUGIN_COMMAND_STATUS"
		$ctrl8 = "CTRL_PLUGIN_STOP_COMMAND"
		$ctrl9 = "CTRL_GET_SLEEP_CONFIG"
		$ctrl10 = "CTRL_MODIFY_SLEEP_CONFIG"
		$ctrl11 = "CTRL_SLEEP_STATUS"
		$ctrl12 = "CTRL_UPDATE_PLUGIN"
		$ctrl13 = "CTRL_DESTROY"
		$ctrl14 = "CTRL_RECONFIG_REBOUNT_ADDRESS"
		$ctrl15 = "CTRL_AUTO_UPLOUD_FILE_CONFIG"
		$ctrl16 = "CTRL_UPLOUD_DEVICE_INFO"
		$ctrl17 = "CTRL_TEST_VPDN_ACCOUNT"

	condition:
		3 of ( $s* ) or 5 of ( $ctrl* )
}