DITEKSHEN_MALWARE_Win_Exmatter

rule DITEKSHEN_MALWARE_Win_Exmatter : FILE
{
	meta:
		description = "Detects BlackMatter data exfiltration tool"
		author = "ditekSHen"
		id = "93df7a68-1e19-5db3-95d4-39d77d1036d8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8303-L8325"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		hash = "4a0e10e1e9fea0906379f99fa350b91c2af37f0fd2cc55491643cc71a9887d30"
		hash = "a5e050f1278473d41c3a3d6f98f3fd82932f51a937bc57d8f5605815f0efb0f8"
		logic_hash = "25a35c82919f96bdba00558616f574e901b83785713ed1a63a6f06df576777cd"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "Renci.SshNet." ascii
		$s2 = "DirNotEmpty" fullword ascii
		$s3 = "MkDir" fullword ascii
		$s4 = "RmDir" fullword ascii
		$s5 = "get_MainWindowHandle" fullword ascii
		$s6 = "GetCurrentProcess" fullword ascii
		$s7 = "]]>]]>" fullword wide
		$s8 = "1.3.132.0.35" fullword wide
		$s9 = "1.3.132.0.34" fullword wide
		$s10 = "1.2.840.10045.3.1.7" fullword wide
		$x1 = "sender2.pdb" fullword ascii
		$x2 = { 64 00 61 00 74 00 61 00 ?? 72 00 6f 00 6f 00 74 }
		$x3 = "157.230.28.192" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $x* ) and 7 of ( $s* ) ) )
}