SEKOIA_Apt_Menupass_Maliciouslibvlc_Dll

import "pe"

rule SEKOIA_Apt_Menupass_Maliciouslibvlc_Dll
{
	meta:
		description = "Detects the malicious LibVLC variants used by MenuPass"
		author = "Sekoia.io"
		id = "8b6b56f3-33b5-41cf-8bcb-e653c98718bd"
		date = "2022-04-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_menupass_maliciouslibvlc_dll.yar#L3-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "de56e112a477d3a77146f1b84c8aa3e66a382a87f1492dd50aa1de9458b33717"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	condition:
		pe.DLL and pe.number_of_exports < 15 and for all i in ( 0 .. pe.number_of_exports - 1 ) : ( pe.export_details [ i ] . name contains "libvlc_" )
}