SEKOIA_Apt_Apt41_Javascript_Dropper

rule SEKOIA_Apt_Apt41_Javascript_Dropper : FILE
{
	meta:
		description = "Detects Earth Lusca JS dropper"
		author = "Sekoia.io"
		id = "fde70806-af50-4706-9daf-d39ad0564fc7"
		date = "2024-02-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_apt41_javascript_dropper.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "3e34af7141e41044c3d3e099e8b8deafc7441ea47ccbd8af7ffe686f10bb18a2"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "eval(function(p, a, c, k, e, r) {"
		$s2 = "|4d53"
		$s3 = "ActiveXObject"
		$x1 = " -F:* %1%"
		$x2 = "&I /r c:\\"
		$x3 = "ActiveXObject"

	condition:
		filesize < 2MB and ( all of ( $s* ) or all of ( $x* ) )
}