SEKOIA_Apt_Unc3524_Quietexit_Strings

rule SEKOIA_Apt_Unc3524_Quietexit_Strings : FILE
{
	meta:
		description = "Detect the QUIETEXIT malware used by UNC3524"
		author = "Sekoia.io"
		id = "1bfa9baa-40a3-4ad7-83dc-f9340fbed180"
		date = "2022-05-04"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_unc3524_quietexit_strings.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "9f8bc7516fdefd94c6bddaf77ea3ac1ba8a3a6380530118c4b28d74b42eaae54"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "Child connection from %s:%s" ascii
		$ = "Failed to run %s" ascii
		$ = "add %s %s %s" ascii
		$ = "/usr/bin/xauth -q" ascii
		$ = "/tmp/dropbear-%" ascii
		$ = "cron" ascii
		$ = { DD E5 D5 97 20 53 27 BF F0 A2 BA CD 96 35 9A AD 1C 75 EB 47 }

	condition:
		uint32be( 0 ) == 0x7f454c46 and filesize > 1MB and 5 of them
}