SEKOIA_Apt_Reaper_2Fa_Phishing_Webpage

rule SEKOIA_Apt_Reaper_2Fa_Phishing_Webpage
{
	meta:
		description = "Detects Reaper 2FA phishing webpage"
		author = "Sekoia.io"
		id = "348ca2ad-c8f9-4aed-8a27-95caa3a34f4b"
		date = "2023-03-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_reaper_2fa_phishing_webpage.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "3f0ae0b35ea181b4712feeb34e866519921917179297148982e5298df9f133a9"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "setTimeout(checkUpload,"
		$ = "commChannel.addListener("
		$ = "else if(commType =="
		$ = "?dir=DOWN&method=READ&id="
		$ = "Content : base64_encode(upload_data)"
		$ = "$.post(upHttpRelayer"
		$ = "var ablyUpData = {"
		$ = "initComm();"
		$ = "function Next(arg) {"

	condition:
		3 of them
}