SEKOIA_Apt_Scanbox_Framework_Not_Obfuscated

rule SEKOIA_Apt_Scanbox_Framework_Not_Obfuscated : FILE
{
	meta:
		description = "Detects the non obfuscated version of ScanBox"
		author = "Sekoia.io"
		id = "4790f122-89de-4f7b-a25f-9ac7b1af8333"
		date = "2022-09-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_scanbox_framework_not_obfuscated.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "52779571eb4e68442542a1c4cff58d5b00a264bb567396126cd93dc4ec4eda45"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "php?m=a&data="
		$ = "php?m=p&data="
		$ = ".fun.split_data = function"
		$ = ".php?data="
		$ = ".php?m=b"
		$ = "basic.apipath"
		$ = ".info.seed ="
		$ = "loadjs ="
		$ = "info.color = screen.colorDepth"

	condition:
		5 of them and filesize < 500KB
}