SEKOIA_Apt_Kimsuky_Klogexe

rule SEKOIA_Apt_Kimsuky_Klogexe : FILE
{
	meta:
		description = "Detects KLogExe, a keylogger used by Kimsuky"
		author = "Sekoia.io"
		id = "f6e3b1a5-43b6-4dac-83c2-a365c41de38d"
		date = "2024-09-27"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_kimsuky_klogexe.yar#L1-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "e1d683ee1746c08c5fff1c4c2b3b02f0"
		hash = "90946c6358eacd119fe1eb36ec7a0a18"
		hash = "9760f489a390665b5e7854429b550c83"
		logic_hash = "4b616908ceacd85c5d8b527cd1a718082c709071dc1fa9c9ccc96e71dc4e7449"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$event = "Norton_BreakHelper" ascii wide
		$log = "------ %d/%d/%d : %d/%d ------" ascii wide
		$keylog_1 = "[RM+]"
		$keylog_2 = "[Tab+]"
		$keylog_3 = "[Home+]"
		$keylog_4 = "[End+]"
		$keylog_5 = "[clip_s]: %s "
		$keylog_6 = "%s[Too many clip_tail]"
		$keylog_7 = "%s[F%d]"
		$user_agent = "Chrome/31.0." wide

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 600KB and 8 of them
}