SEKOIA_Apt_Gamaredon_Ddrdoh_Powershell_Backdoor

rule SEKOIA_Apt_Gamaredon_Ddrdoh_Powershell_Backdoor : FILE
{
	meta:
		description = "Detects GAMAREDON's DDRDOH PowerShell Backdoor"
		author = "Sekoia.io"
		id = "3413dedd-e3ec-4231-8af7-c7f709ab82d7"
		date = "2023-01-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_gamaredon_ddrdoh_powershell_backdoor.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "32d088affb65d410b2715fde28227792ea9f406e324de4a2e204e9850f0b81ce"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "hidden iex $env:" ascii wide
		$ = ".substring(0,4) -eq \"http" ascii wide
		$ = ".split('!')[1];" ascii wide
		$ = " -bxor $key[$i % $key.Length]" ascii wide
		$s = "Filter $fil | Select-Object VolumeSerialNumber" ascii wide

	condition:
		uint8( 0 ) == 0x24 and 4 of them and filesize < 10KB
}