VOLEXITY_Malware_Win_Backwash_Iis_Scout

rule VOLEXITY_Malware_Win_Backwash_Iis_Scout : WHEELEDASH FILE MEMORY
{
	meta:
		description = "Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines."
		author = "threatintel@volexity.com"
		id = "1f768b39-21a0-574d-9043-5104540003f7"
		date = "2021-11-17"
		modified = "2023-08-17"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2021/2021-12-06 - XEGroup/indicators/yara.yar#L50-L78"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "6f44a9c13459533a1f3e0b0e698820611a18113c851f763797090b8be64fd9d5"
		logic_hash = "18c4e338905ff299d75534006037e63a8f9b191f062cc97b0592245518015f88"
		score = 75
		quality = 80
		tags = "WHEELEDASH, FILE, MEMORY"
		scan_context = "file,memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6145
		version = 3

	strings:
		$s1 = "SOAPRequest" ascii
		$s2 = "requestServer" ascii
		$s3 = "getFiles" ascii
		$s4 = "APP_POOL_CONFIG" wide
		$s5 = "<virtualDirectory" wide
		$s6 = "stringinstr" ascii
		$s7 = "504f5354" wide
		$s8 = "XValidate" ascii
		$s9 = "XEReverseShell" ascii
		$s10 = "XERsvData" ascii

	condition:
		6 of them
}