DITEKSHEN_MALWARE_Win_Trickbotmodule

rule DITEKSHEN_MALWARE_Win_Trickbotmodule : FILE
{
	meta:
		description = "Detects Trickbot modules"
		author = "ditekshen"
		id = "c56c664f-5928-5e2e-ab06-0b9d504981be"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3860-L3881"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4d06653dad5f8a18598855212548364b3c3d2b68b99784846b494fcb1d1c8df9"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$mc = "<moduleconfig>" ascii
		$s1 = "<autostart>" ascii
		$s2 = "<nohead>" ascii
		$s3 = "<needinfo" ascii
		$s4 = "<conf ctl" ascii
		$s5 = "<limit>" ascii
		$w1 = "<sys>yes</sys>" ascii
		$w2 = "<sys>no</sys>" ascii
		$w3 = "<autostart>yes</autostart>" ascii
		$w4 = "<autostart>no</autostart>" ascii
		$w5 = "<nohead>yes</nohead>" ascii
		$w6 = "<nohead>no</nohead>" ascii
		$w7 = /<limit>\d+<\/limit>/ ascii
		$w8 = "<moduleconfig> </moduleconfig" ascii

	condition:
		uint16( 0 ) == 0x5a4d and $mc and ( 2 of ( $s* ) or ( 1 of ( $s* ) and 1 of ( $w* ) ) or 1 of ( $w* ) )
}