DITEKSHEN_MALWARE_Win_Tmanager

rule DITEKSHEN_MALWARE_Win_Tmanager : FILE
{
	meta:
		description = "Detects TManager RAT. Associated with TA428"
		author = "ditekSHen"
		id = "391b72bd-ddf5-5251-b566-c75c1cc16b74"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4391-L4410"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cdbcc00ae67c9161f6db89cfa658c8bc8fb7fab3915ac5ae99bdd34c42ee2abb"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "WSAStartup Error!" fullword wide
		$s2 = "KB3112342.LOG" fullword wide
		$s3 = "\\cmd.exe -c" fullword wide
		$s4 = "sock_hmutex" fullword wide
		$s5 = "cmd_hmutex" fullword wide
		$s6 = "powershell" fullword wide
		$s7 = "%s_%d.bmp" fullword wide
		$s8 = "!Error!" fullword wide
		$s9 = "[Execute]" fullword ascii
		$s10 = "[Snapshot]" fullword ascii
		$s11 = "GetLanIP error!" fullword ascii
		$s12 = "chcp & exit" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}