VOLEXITY_Apt_Malware_Win_Superstomp

rule VOLEXITY_Apt_Malware_Win_Superstomp : JUNGLEBAMBOO SUPERSTOMP FILE MEMORY
{
	meta:
		description = "Detection for the SUPERSTOMP malware used by JungleBamboo."
		author = "threatintel@volexity.com"
		id = "7719e855-70d7-56a9-9888-9d6f6a9afc2f"
		date = "2026-09-08"
		modified = "2026-09-08"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2026/2026-09-09 Chrome/rules.yar#L38-L73"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3"
		logic_hash = "b1e4c1f0bf614dae29ca534205792efe24605a2807e3a9c67f8c6e99aa153bfa"
		score = 75
		quality = 80
		tags = "JUNGLEBAMBOO, SUPERSTOMP, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		report1 = "TIB-20260908B"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 13427
		version = 3

	strings:
		$stomp_ua = "stomp/1.0" wide
		$stomp_pem = "stomp_ext_key.pem" wide
		$stomp_spki = "stomp_ext_key.spki" wide
		$stomp_bak = "stomp.bak" wide
		$xor_key = { 5a c3 17 8e f0 2b 96 41 7d 0a e8 33 b5 64 1f da }
		$browser_secpref = "Secure Preferences" wide
		$browser_extsettings = "extensions.settings." ascii
		$browser_devmode = "extensions.ui.developer_mode" ascii
		$browser_taskkill = "cmd.exe /c taskkill /F /IM " wide
		$browser_restore = "--restore-last-session" wide

	condition:
		3 of ( $stomp* ) or $xor_key or all of ( $browser* )
}