SEKOIA_Apt_Mustangpanda_Xoreddll

rule SEKOIA_Apt_Mustangpanda_Xoreddll : FILE
{
	meta:
		description = "Detects xored DLL from MustangPanda embedding a document"
		author = "Sekoia.io"
		id = "73d13624-01df-41ab-b449-86db43dc6c55"
		date = "2022-07-19"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_mustangpanda_xoreddll.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "685be191cf187c0d5bfd00354400c47a961c9d047aa7e65e4cfc2201ec5eb1bc"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$clear = "This program cannot be run in DOS mode"
		$stub = "This program cannot be run in DOS mode" xor
		$res1 = "5w>w9wR'31Z" xor
		$res2 = "r0y0~0KlBD" xor
		$res3 = "d&o&h&öé7Æ" xor
		$res4 = "9{2{5{+0" xor

	condition:
		$stub and any of ( $res* ) and not $clear and filesize < 3MB
}