SEKOIA_Apt_Muddywater_Manifestation_Backdoor

rule SEKOIA_Apt_Muddywater_Manifestation_Backdoor : FILE
{
	meta:
		description = "Detects Muddys manifestation JScript backdoor"
		author = "Sekoia.io"
		id = "998fb0ab-73ed-41e5-b87e-f987b8f05a8c"
		date = "2022-01-13"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_muddywater_manifestation_backdoor.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "477ed53ccd337dd21ab84b7d36b995a653d0aad6676e02cbe5e9f581bface253"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "/^\\s+|\\s+$/g" ascii
		$l2 = "while (1) {" ascii
		$l3 = { 57 53 63 72 69 70 74 2e 73 6c 65 65 70 28 ?? ?? 20 2a 20 31 30 30 30 29 3b }
		$s4 = ")+ key , false)" ascii
		$s5 = ")+ data , false)" ascii

	condition:
		filesize > 1000 and ( $l3 in ( @l2 .. @l2 + 300 ) ) and ( any of ( $s* ) )
}