SEKOIA_Apt_37_Chinotto

rule SEKOIA_Apt_37_Chinotto : FILE
{
	meta:
		description = "Detects obfuscation and string of APT37 stealer"
		author = "Sekoia.io"
		id = "eff8fd11-dc7a-4011-b083-181d0cca8790"
		date = "2023-02-27"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_37_chinotto.yar#L1-L50"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "feab7940559392bbf38f29267509340569160e0a3b257fd86e5c65ae087ea014"
		hash = "c9d2c8b6011a53e68e4a6c6e51142cef3348951d0b379e49b1a65a1891538df5"
		hash = "2f5be3773e7e3a2f6806cdef154adfabc454c0e57a49e437c5889ce09b739302"
		hash = "5bf170c95ca0e2079653d694f783b5bcd38f274ea875f67f0b60db4ac552a66c"
		hash = "6fad04c836bc923f12ebaec8d8fb0c7091b044bf6f5c97e36d7bf46b8494f978"
		hash = "64fe964f342acca6d85d247c4f67503e4222a58dfc5c644dedc2006a4b356d39"
		hash = "6e216b265ea391f71f2a609df995f36b9ba8b17c8859f6d8e4ce4a076d351efd"
		hash = "70dcc03cde3dd5c5ec6a6a240190cfb51667aaba9c867e20281e8dfc43afa891"
		hash = "5053390bde150b771f8efe344b692c6c5718ba9203a4b23f5323af1ee9060ff2"
		hash = "089e4dfd8b25afe596eff05baae86156a4e3243c84faa15416cff31a5120e107"
		hash = "37e096338a78cb06d6236cb5a04cf125f191871ded3c9421f08a37890a095eb8"
		hash = "b90a2b0249407b271a5d849fe82cbf4e9a31c2c6259caf515c9be3897e327414"
		hash = "8f4751ed22619b04009c4b85ec45c8140b570835ca4c638c9e6019e7b7eb66c7"
		logic_hash = "a721f102b4c9568379649f8004fa4eb460240145ab829d8ce3740dafb52d13c8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$chunk_1 = {
        C7 85 ?? ?? ?? ?? ?? ?? ?? 00
        C7 85 ?? ?? ?? ?? ?? ?? ?? 00
        33 C0
        EB 03
        8D 49 00
        8B 8C 85 ?? ?? ?? ??
        3B 8C 85 ?? ?? ?? ??
        }
		$chunk_2 = {
        C7 84 24 ?? ?? ?? ?? ?? ?? 0? 00
        C7 84 24 ?? ?? ?? ?? ?? ?? 0? 00
        33 C0
        EB 0D
        8D A4 24 00 00 00 00
        8D 9B 00 00 00 00
        8B 8C 84 ?? ?? ?? ??
        3B 8C 84 ?? ?? ?? ??
        }
		$movs_zip_dir_start = { C7 45 ?? 5A 69 70 20 C7 45 ?? 44 69 72 20 C7 45 ?? 53 74 61 72  C7 45 ?? 74 20 2D 20}

	condition:
		( uint32be( 0 ) == 0x7f454c46 or uint16be( 0 ) == 0x4d5a ) and filesize < 1MB and ( $chunk_1 or $chunk_2 ) and $movs_zip_dir_start
}