WITHSECURELABS_Ducktail_Artifacts

rule WITHSECURELABS_Ducktail_Artifacts : FILE
{
	meta:
		description = "Detects artifacts found in files associated to DUCKTAIL malware"
		author = "WithSecure"
		id = "937c9688-b74f-5e02-838f-ab6757a8d2a1"
		date = "2022-07-18"
		modified = "2022-07-26"
		reference = "https://labs.withsecure.com/publications/ducktail"
		source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/DUCKTAIL/ducktail_artifacts.yar#L1-L20"
		license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
		hash = "3dbd9e1c3d0fd6358d4adcba04fdfc0b6e8acc49"
		hash = "9370243589327b458486e3f7637779c2a96b4250"
		hash = "b98170b18b906aee771dbd4dbd31e5963a90a50e"
		logic_hash = "1daa5e654058c802826b6a306b5bfc9d0c05c4ee54607e94e618a8d409ce74d9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1.0"

	strings:
		$pdb_path_1 = /[a-z]\:\\projects\\(viruttest|virot)\\/i nocase ascii
		$pdb_path_2 = /[a-z]\:\\users\\ductai\\/i nocase ascii
		$pdb_path_3 = "\\dataextractor.pdb" nocase ascii
		$email = "ductai2308@gmail.com" wide ascii

	condition:
		uint16( 0 ) == 0x5A4D and any of them
}