SEKOIA_Backdoor_Win_Mgbot_Main

import "pe"
import "hash"

rule SEKOIA_Backdoor_Win_Mgbot_Main
{
	meta:
		description = "Detect MgBot main.dll file"
		author = "Sekoia.io"
		id = "528baa11-58d5-470a-bd6d-963d4ac75d97"
		date = "2024-03-20"
		modified = "2024-12-19"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt-attacks-telecoms-africa-mgbot"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/backdoor_win_mgbot_main.yar#L4-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "706c9030c2fa5eb758fa2113df3a7e79257808b3e79e46869d1bf279ed488c36"
		hash = "017187a1b6d58c69d90d81055db031f1a7569a3b95743679b21e44ea82cfb6c7"
		logic_hash = "61b335c88ce8bc56396b597c7c6f27b1d431941682401f0b3950c80edf7d8403"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	condition:
		pe.imphash( ) == "8e1ee04a99c77bd54c6dc55214ffa2e3" or hash.md5 ( pe.rich_signature.clear_data ) == "67e8e8b75b981b5c8ff31149dc2c61b2" or for any i in ( 0 .. pe.number_of_sections -1 ) : ( hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "7c6adf9987e6dfbf19b5f156b0314798" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "46fa9f5a035c8ae8de1a0d14150bd5ef" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "f7895f9456f8d51125e6744960c38133" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "5d82bb8a7ef37c417615381b446f715c" ) or for any i in ( 0 .. pe.number_of_resources -1 ) : ( hash.sha256 ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) == "d7808c6662f098e685040f7c61bc033d9e73002f674de7cf2ffcd6230d60d429" )
}