SEKOIA_Apt_Unc4990_Emptyspace_Pyc

rule SEKOIA_Apt_Unc4990_Emptyspace_Pyc : FILE
{
	meta:
		description = "Detects Python Bytecode of EmptySpace"
		author = "Sekoia.io"
		id = "d970fd9c-1ce5-471c-96a1-146250f36b89"
		date = "2024-02-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_unc4990_emptyspace_pyc.yar#L1-L43"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "98e9c848f6b6276815b040681d7f36548b367257bb75d133309e89e8572a50b7"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "PYBOOTSTRAP"
		$ = "http://google.com/generate_204"
		$ = "from"
		$ = "pathZ"
		$ = "usernamez"
		$ = "timeZ"
		$ = "win32api"
		$ = "base64Z"
		$ = "json"
		$ = "marshalZ"
		$ = "BOOTSTRAP_VERSION"
		$ = "getZ"
		$ = "sleepZ    b64encode"
		$ = "dumps"
		$ = "executableZ"
		$ = "GetUserNameExZ"
		$ = "NameSamCompatible"
		$ = "encode"
		$ = "decodeZ"
		$ = "request_dataZ"
		$ = "server"
		$ = "post"
		$ = "raise_for_status"
		$ = "exec"
		$ = "loadsZ    b64decode"
		$ = "text"
		$ = "globals"
		$ = "bootstrap.py"
		$ = "<module>"

	condition:
		uint32be( 0 ) == 0x420d0d0a and all of them
}