DITEKSHEN_MALWARE_Win_Kimsuky

rule DITEKSHEN_MALWARE_Win_Kimsuky : FILE
{
	meta:
		description = "Detects Kimsuky backdoor"
		author = "ditekshen"
		id = "6216b874-13f1-5283-9d17-90b7ca6996f8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2707-L2730"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9f9e64a9cfb3f61bc6b355035c5f0644e4750b740e05cb557c6183c7acfc5a19"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Kimsuky"

	strings:
		$s1 = "Win%d.%d.%dx64" fullword ascii
		$s2 = ".zip" fullword ascii
		$s3 = ".enc" fullword ascii
		$s4 = "&p2=a" fullword ascii
		$s5 = "Content-Disposition: form-data; name=\"binary\"; filename=\"" fullword ascii
		$s6 = "%s/?m=a&p1=%s&p2=%s-%s-v%d" fullword ascii
		$s7 = "/?m=b&p1=" fullword ascii
		$s8 = "/?m=c&p1=" fullword ascii
		$s9 = "/?m=d&p1=" fullword ascii
		$s10 = "http://%s/%s/?m=e&p1=%s&p2=%s&p3=%s" fullword ascii
		$s11 = "taskkill.exe /im iexplore.exe /f" fullword ascii
		$s12 = "GetParent" fullword ascii
		$s13 = "DllRegisterServer" fullword ascii
		$dll1 = "AutoUpdate.dll" fullword ascii
		$dll2 = "dropper-ie64.dll" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $dll* ) and 7 of ( $s* ) ) or ( 11 of ( $* ) ) )
}