DITEKSHEN_MALWARE_Osx_Windtrail

rule DITEKSHEN_MALWARE_Osx_Windtrail : FILE
{
	meta:
		description = "Detects WindTrail OSX trojan"
		author = "ditekSHen"
		id = "abf7cd20-b37d-5d0a-8f3f-f4e491965713"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3189-L3206"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "291f919cb1e8c4b33960dd3f2c842b9efec04852bd5661543e3ee60bc0fc5ba6"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Osx.Trojan.WindTrail"

	strings:
		$s1 = "m_ComputerName_UserName" fullword ascii
		$s2 = "m_uploadURL" fullword ascii
		$s3 = "m_logString" fullword ascii
		$s4 = "GenrateDeviceName" fullword ascii
		$s5 = "open -a" fullword ascii
		$s6 = "AESEncryptFile:toFile:usingPassphrase:error:" fullword ascii
		$s7 = "scheduledTimerWithTimeInterval:target:selector:userInfo:repeats:" fullword ascii
		$s8 = "_kLSSharedFileListSessionLoginItems" fullword ascii
		$developerid = "Developer ID Application: warren portman (95RKE2AA8F)" ascii

	condition:
		uint16( 0 ) == 0xfacf and ( all of ( $s* ) or $developerid )
}