SEKOIA_Apt_Mustangpanda_Payload

rule SEKOIA_Apt_Mustangpanda_Payload : FILE
{
	meta:
		description = "Decryption routine of mustang panda payload"
		author = "Sekoia.io"
		id = "ce7ddf20-e13f-4b5f-8fff-4b1387b29568"
		date = "2022-12-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_mustangpanda_payload.yar#L1-L42"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "734d42aed4574de620773f1f2d08c6b1fc206efd1b576f0f3679edcc0b2ce91d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$chunk_1 = {
        89 74 24 ??
        B9 ?? ?? ?? ??
        8B 44 24 ??
        3D ?? ?? ?? ??
        B8 ?? ?? ?? ??
        0F 4C C1
        E9 ?? ?? ?? ??
        B8 ?? ?? ?? ??
        31 DB
        31 ED
        31 FF
        E9 ?? ?? ?? ??
        8B 44 24 ??
        B9 ?? ?? ?? ??
        3B 44 24 ??
        B8 ?? ?? ?? ??
        0F 42 C1
        E9 ?? ?? ?? ??
        88 5C 24 ??
        89 6C 24 ??
        89 7C 24 ??
        B9 ?? ?? ?? ??
        8B 44 24 ??
        3D ?? ?? ?? ??
        B8 ?? ?? ?? ??
        0F 4C C1
        }

	condition:
		filesize < 8MB and all of them
}