BLACKBERRY_Mal_Infostealer_MSI_EXE_Jupyter_Certificate

rule BLACKBERRY_Mal_Infostealer_MSI_EXE_Jupyter_Certificate : FILE
{
	meta:
		description = "Detects Jupter by certificate"
		author = "BlackBerry Threat Research Team"
		id = "837fdc85-d5ac-560b-bc49-6e34eb216e93"
		date = "2021-11-04"
		modified = "2022-07-06"
		reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_MSI_EXE_Jupyter_Certificate.yar#L1-L43"
		license_url = "N/A"
		logic_hash = "5524f227e4c0090b923d7966223806dd384458178083b752ebd9e0981b3fba52"
		score = 75
		quality = 83
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

	strings:
		$msi = { D0 CF 11 E0 A1 B1 1A E1 }
		$a1 = "EMCO MSI Package Builder"
		$b1 = "powershell-ExecutionPolicy bypass -command \"iex([\\[]IO.File[\\]]::ReadAllText('[CurrentUserProfileFolder]" nocase
		$b2 = "powershell-ep bypass -file \"[AppDataFolder]" nocase
		$b3 = /powershell-ep bypass -windowstyle hidden -command \"\$xp=\'\[AppDataFolder\].{0,256}\.{0,256}\'/ nocase
		$b4 = /powershell-ep bypass -windowstyle hidden -command \"\$p=\'\[AppDataFolder\].{0,256}\.{0,256}\'/ nocase
		$b5 = /powershell-ExecutionPolicy bypass -command \"iex\(\[\\\[\]IO.File\[\\\]\]::ReadAllText\(\'\[CurrentUserProfileFolder\].{1,256}\..{1,256}\'\)\)/ nocase
		$c1 = "OOO ENDI"
		$c2 = "OOO MVS"
		$c3 = "OOO LEVELAP"
		$c4 = "Soto Manufacturing SRL"
		$c5 = "Decapolis Consulting Inc."
		$f1 = "SSL.com EV Root Certification Authority RSA R2"
		$f2 = "SSL.com EV Code Signing Intermediate CA RSA R3"
		$f3 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
		$f4 = "DigiCert Trusted Root G40"

	condition:
		($msi at 0 or uint16( 0 ) == 0x5a4d ) and all of ( $a* ) and 1 of ( $b* ) and 1 of ( $c* ) and 2 of ( $f* )
}