DITEKSHEN_MALWARE_Win_Ducktail

rule DITEKSHEN_MALWARE_Win_Ducktail : FILE
{
	meta:
		description = "Detects DuckTail"
		author = "ditekSHen"
		id = "2d1a8f9e-ed5f-53fa-8ba8-b6d1344f6d39"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9963-L9991"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a416212e5f87b33fdc14590c3d6d6ebc2915c2b383adf78d660c9408beb2323f"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "&global_scope_id=" wide
		$s2 = "#ResolveMyIpAll" wide
		$s3 = "#ApproveInvitesHandler" wide
		$s4 = "#ProcessShareCok" wide
		$s5 = "#InviteEmpHandler" wide
		$s6 = "__activeScenarioIDs=%" wide
		$s7 = "&__a=1&fb_dtsg=" wide
		$s8 = "adAccountLimit\":(.*?)}" wide
		$s9 = "|PUSH|" fullword wide
		$s10 = "|SCREEN|" fullword wide
		$s11 = "|SCREEC|" fullword wide
		$s12 = "_ad_accounts>k__" ascii
		$s13 = "get_Pwds" fullword ascii
		$s14 = "Telegram.Bot" ascii
		$s15 = { 2f 00 7b 00 43 00 59 00 52 00 7d 00 2e 00 74 00
               78 00 74 00 00 15 2f 00 7b 00 4c 00 4f 00 47 00
               7d 00 2e 00 74 00 78 00 74 00 00 15 2f 00 7b 00
               43 00 46 00 47 00 7d 00 2e 00 74 00 78 00 74 00
               00 15 2f 00 7b 00 50 00 52 00 53 00 7d 00 2e 00
               74 00 78 00 74 00 00 15 2f 00 7b 00 53 00 43 00
               52 00 7d 00 2e 00 6a 00 70 00 67 }

	condition:
		uint16( 0 ) == 0x5a4d and 13 of them
}