SEKOIA_Downloader_Mac_Rustbucket_Swiftloader

rule SEKOIA_Downloader_Mac_Rustbucket_Swiftloader
{
	meta:
		description = "Detect the file com.EdoneViewer in the new version of RustBucker 2023-10"
		author = "Sekoia.io"
		id = "bdbc95db-5d58-4c96-91f9-34b653e67f50"
		date = "2023-12-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/downloader_mac_rustbucket_swiftloader.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "7c5bf60787bfd076c8806eaa4f1185f5b9fda69008376624ab3d17f207eb16a4"
		hash = "bc90adde92bd47b4de7d384e5b20c1a1791d603629bd0fcba4b550fb35e93216"
		hash = "c9a7b42c7b29ca948160f95f017e9e9ae781f3b981ecf6edbac943e52c63ffc8"
		logic_hash = "acb5b88f8af53cd3d83de0fd6c3049ce017f038dc7c8b31f70e65e60bf713dfb"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "/Users/ghost/Desktop/EdoneViewer/EdoneViewer/"
		$ = "EdoneViewerApp.swift"

	condition:
		1 of them
}