DITEKSHEN_MALWARE_Win_Rietspoof

rule DITEKSHEN_MALWARE_Win_Rietspoof : FILE
{
	meta:
		description = "Rietspoof payload"
		author = "ditekSHen"
		id = "b2d94705-ca59-56ae-8471-2c6895d355dc"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1110-L1140"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d1d9baab83c904d1e8dcd7aeacdabfc79c1acee67006793c2240a42ebf9c62b2"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Rietspoof"

	strings:
		$c1 = "%s%s%s USER: user" fullword ascii
		$c2 = "cmd /c %s" fullword ascii
		$c3 = "CreateObject(\"Scripting.FileSystemObject\").DeleteFile(" ascii
		$c4 = "WScript.Quit" fullword ascii
		$c5 = "CPU: %s(%d)" fullword ascii
		$c6 = "RAM: %lld Mb" fullword ascii
		$c7 = "data.dat" fullword ascii
		$c8 = "%s%s%s USER:" ascii
		$v1_1 = ".vbs" ascii
		$v1_2 = "HELLO" ascii
		$v1_3 = "Wscript.Sleep" ascii
		$v1_4 = "User-agent:Mozilla/5.0 (Windows; U;" ascii
		$v2_1 = "Xjoepxt!" ascii
		$v2_2 = "Content-MD5:%s" fullword ascii
		$v2_3 = "M9h5an8f8zTjnyTwQVh6hYBdYsMqHiAz" fullword ascii
		$v2_4 = "GET /%s?%s HTTP/1.1" fullword ascii
		$v2_5 = "GET /?%s HTTP/1.1" fullword ascii
		$pdb1 = "\\techloader\\loader\\loader.odb" ascii wide
		$pdb2 = "\\loader\\Release\\loader_v1.0.pdb" ascii wide

	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of ( $c* ) and ( 3 of ( $v* ) or 1 of ( $pdb* ) ) )
}