SEKOIA_Apt_Uta0218_Upstyle_Backdoor_Strings

rule SEKOIA_Apt_Uta0218_Upstyle_Backdoor_Strings : FILE
{
	meta:
		description = "Detects UPSTYLE backdoor"
		author = "Sekoia.io"
		id = "098fbad7-efaf-4198-83de-208c2ae16f89"
		date = "2024-04-16"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_uta0218_upstyle_backdoor_strings.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "bcba657b0b302f4b46f09bc4b815a581d22208b5d9f99e1233878f775241f92e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1_1 = "f.write(b'''import base64;exec(base64.b64decode(b" ascii
		$s1_2 = "atime=os.path.getatime(" ascii
		$s2_1 = "exec(base64.b64decode(functioncode))" ascii base64
		$s2_2 = "os.path.exists(systempth):" ascii base64
		$s2_3 = ".read().replace(b\"\\x00\",b\" \")" ascii base64
		$s3_1 = "if WRITE_FLAG:" ascii base64
		$s3_2 = "re.search(SHELL_PATTERN" ascii base64
		$s3_3 = "import threading,time,os,re,base64" ascii base64

	condition:
		filesize < 1500 and ( 2 of ( $s1_* ) or 2 of ( $s2_* ) or 2 of ( $s3_* ) )
}