SEKOIA_Apt_Apt35_Iisraid_Strings

rule SEKOIA_Apt_Apt35_Iisraid_Strings : FILE
{
	meta:
		description = "Detects APT35s ISSRaid implant"
		author = "Sekoia.io"
		id = "ee42f406-0c7e-4385-9098-409611dbe0a5"
		date = "2023-05-11"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_apt35_iisraid_strings.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "de2ebef5ab46136aa54b146dbd4198f69801f3414d1d239fc7983c5b3c0115c4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "CHttpModule::"
		$ = "X-Forward-Verify"
		$ = "X-Beserver-Verify"

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 500KB and all of them
}