SEKOIA_Backdoor_Win_Volgmer

rule SEKOIA_Backdoor_Win_Volgmer : FILE
{
	meta:
		description = "Detect the NukeSped variant called Volgmer used by Andariel"
		author = "Sekoia.io"
		id = "9468a66d-787c-488f-937b-22617c7a2ded"
		date = "2023-09-04"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/backdoor_win_volgmer.yar#L1-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "3098e6e7ae23b3b8637677da7bfc0ba720e557e6df71fa54a8ef1579b6746061"
		hash = "7339cfa5a67f5a4261c18839ef971d7f96eaf60a46190cab590b439c71c4742b"
		hash = "8daa6b20caf4bf384cc7912a73f243ce6e2f07a5cb3b3e95303db931c3fe339f"
		hash = "1b88b939e5ec186b2d19aec8f17792d493d74dd6ab3d5a6ddc42bfe78b01aff1"
		logic_hash = "700fcfcc3df1d81af99db38e305f64ca87f8368fc0149c9ad64d75c2917ec1f3"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "Fixed" wide
		$ = "CDRom" wide
		$ = "Removable" wide
		$ = "%.2fGB" wide
		$ = "\\*.*" wide
		$ = "Folder" wide
		$ = "%.1fKB" wide
		$ = "%.1fMB" wide
		$ = "%s\\*.*" wide
		$ = "%s\\%s\\%s" wide
		$ = "%s\\%s%s" wide
		$ = "Remote PC" wide
		$ = "%s|%s|%s|%s|%s|%s|" wide
		$ = "%s\\cmd.exe" wide

	condition:
		uint16be( 0 ) == 0x4d5a and all of them
}