VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_Core

rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_Core : BRAZENBAMBOO FILE MEMORY
{
	meta:
		description = "Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc."
		author = "threatintel@volexity.com"
		id = "44f8d7a4-7f48-5960-91a7-baf475f7d291"
		date = "2024-02-15"
		modified = "2024-07-03"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2024/2024-11-15 BrazenBamboo/rules.yar#L244-L287"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "80c0cdb1db961c76de7e4efb6aced8a52cd0e34178660ef34c128be5f0d587df"
		logic_hash = "f0189c0a84c53e365130e9683f2f2b2f73c14412d8e4d0251a4780d0e80162d8"
		score = 75
		quality = 78
		tags = "BRAZENBAMBOO, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10246
		version = 2

	strings:
		$s1 = "Enter RunWork......."
		$s2 = "it's running......."
		$s3 = "select ret = socket_error."
		$s4 = "%s\\\\account.bin"
		$s5 = "[CtrlLink]: get machine sn err:%d"
		$s6 = "wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /format:list | findstr /v \\\"^$\\\""
		$s7 = "wmic csproduct get vendor,version /format:list | findstr /v \\\"^$\\\""
		$s8 = "local ip get sockname error=%d"
		$s9 = "connect goole dns error=%d"
		$s10 = "%s/api/terminal/upsert/"
		$s11 = "/963852741/windows/plugin/manifest"
		$s12 = "Hello deepdata."
		$s13 = "Start Light."
		$s14 = "InitialPluginManager Error."
		$s15 = "InitialCommandExe Error."
		$s16 = "ws open, and send logon info."
		$s17 = "plugin_replay_handler"
		$s18 = "light_x86.dll"
		$pdb1 = "\\light\\bin\\light_x86.pdb"
		$pdb2 = "\\light\\bin\\plugin"
		$pdb3 = "D:\\tmpWork\\"

	condition:
		1 of ( $pdb* ) or 5 of ( $s* )
}