DITEKSHEN_MALWARE_Win_CRAT

rule DITEKSHEN_MALWARE_Win_CRAT : FILE
{
	meta:
		description = "Detects CRAT main DLL"
		author = "ditekSHen"
		id = "9757a8de-61ea-55c0-b64c-055798450985"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1922-L1944"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5a9fef68e110a1564dd5956408abcc3736cfa6853e1ac5510a089cc68f6bdc35"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "cmd /c \"dir %s /s >> %s\"" wide
		$s2 = "Set-Cookie:\\b*{.+?}\\n" wide
		$s3 = "Location: {[0-9]+}" wide
		$s4 = "Content-Disposition: form-data; name=\"%s\"; filename=\"" ascii
		$s6 = "%serror.log" wide
		$v2x_1 = "?timestamp=%u" wide
		$v2x_2 = "config.txt" wide
		$v2x_3 = "entdll.dll" wide
		$v2x_4 = "\\cmd.exe" wide
		$v2x_5 = "[MyDocuments]" wide
		$v2x_6 = "@SetWindowTextW FindFileExA" wide
		$v2x_7 = "Microsoft\\Windows\\WinX\\Group1\\*.exe" wide
		$v2s_1 = "Installed Anti Virus Programs" ascii
		$v2s_2 = "Running Processes" ascii
		$v2s_3 = "id=%u&content=" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 6 of ( $v2x* ) or all of ( $v2s* ) or ( 2 of ( $v2s* ) and 4 of ( $v2x* ) ) )
}