SEKOIA_Apt_Sandworm_Olympicdestroyer

rule SEKOIA_Apt_Sandworm_Olympicdestroyer : FILE
{
	meta:
		description = "Detects OlympicDestroyer malware"
		author = "Sekoia.io"
		id = "6820eb32-fea2-4a00-a5a2-672ba09f8206"
		date = "2022-04-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_sandworm_olympicdestroyer.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "a68a96ab036e69a32e173b2d2fa6a81ab872032f89bfdfc3cd4446305a33921b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "cmd.exe /c (ping 0.0.0.0 > nul)" wide
		$ = "if exist %programdata%\\evtchk.txt" wide
		$ = "\\\\.\\pipe\\%ls" wide
		$ = "%ProgramData%\\%COMPUTERNAME%.exe" wide
		$ = "(exit 5) else ( type nul >" wide
		$ = "Select * From Win32_ProcessStopTrace" nocase

	condition:
		uint16be( 0 ) == 0x4d5a and 3 of them
}