DITEKSHEN_MALWARE_Win_Konni

rule DITEKSHEN_MALWARE_Win_Konni : FILE
{
	meta:
		description = "Konni payload"
		author = "ditekSHen"
		id = "86eae9f6-60b0-5720-8528-ddbe32b6d4a6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L512-L530"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d57c51f7ede28b74395e5e0fbcc5fd9247b3353330f3e549d5abf99bbd7a1b93"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "uplog.tmp" fullword wide
		$s2 = "upfile.tmp" fullword wide
		$s3 = "%s-log-%s" fullword ascii wide
		$s4 = "%s-down" ascii wide
		$s5 = "%s-file-%s" fullword ascii wide
		$s6 = "\"rundll32.exe\" \"%s\" install" fullword wide
		$s7 = "subject=%s&data=" fullword ascii
		$s8 = "dll-x64.dll" fullword ascii
		$s9 = "dll-x32.dll" fullword ascii
		$pdb1 = "\\virus-dropper\\Release\\virus-dropper.pdb" ascii
		$pdb2 = "\\virus-init\\Release\\virus-init.pdb" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $pdb* ) ) )
}