SEKOIA_Apt_Cottonsandstorm_Win_Implant

rule SEKOIA_Apt_Cottonsandstorm_Win_Implant : FILE
{
	meta:
		description = "Detects a simple win implant used by Cotton Sandstorm"
		author = "Sekoia.io"
		id = "04a5255c-f9bb-4612-b0e2-ed0326867055"
		date = "2024-11-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_cottonsandstorm_win_implant.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "f797d71ed07d6e05556300e4ce0f2927"
		logic_hash = "dcb25ee236ca52f23cc6bfdbcedcbc6d407e88f06341e684f202a59954733ade"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "DIR =>" wide
		$ = "type=machines&md5=" wide
		$ = "File =>" wide
		$ = "&ip=" wide fullword
		$ = "&un=" wide fullword
		$ = "&cp=" wide fullword
		$ = "myFile\";filename=" ascii
		$ = "ifB75BcjsRBhy2et" ascii

	condition:
		uint16be( 0 ) == 0x4d5a and 4 of them and filesize < 500KB
}