SEKOIA_Apt_Muddywater_Powgoop_Decoded

rule SEKOIA_Apt_Muddywater_Powgoop_Decoded : FILE
{
	meta:
		description = "Detects decoded PowGoop malware"
		author = "Sekoia.io"
		id = "194cb9ef-da96-42b6-a3b5-b0aee7495f2c"
		date = "2022-01-13"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_muddywater_powgoop_decoded.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "6654d8107bb2ad6344f1fa03c6525ed9a0b8e49627787355efe857e80a02eca4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$h1 = "[System.Net.WebRequest]::Create(" ascii wide
		$h2 = "Headers.Add('Authorization'" ascii wide
		$h3 = "Headers.Add('Cookie',('value=' + $ec + ';')" ascii wide
		$h4 = ".GetResponse()" ascii wide
		$h5 = "GetResponseStream()" ascii wide
		$c1 = "return (65..90) + (97..122) | Get-Random -Count" ascii wide
		$c2 = "% {[char]$_}" ascii wide

	condition:
		filesize > 1KB and filesize < 1MB and ( $h2 in ( @h1 .. @h5 ) and $h3 in ( @h1 .. @h5 ) and $h4 in ( @h1 .. @h5 ) ) or ( $c2 in ( @c1 .. @c1 + 50 ) ) and true
}