SEKOIA_Downloader_Win_Apt33_Tickler

import "pe"
import "hash"

rule SEKOIA_Downloader_Win_Apt33_Tickler : FILE
{
	meta:
		description = "Detect the downloader used by APT33 to diwnload Tickler"
		author = "Sekoia.io"
		id = "e1f704d6-d527-479a-8311-d286c06768ac"
		date = "2024-08-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/downloader_win_apt33_tickler.yar#L4-L29"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "e6fff291b73812e5a999fbc566e8f7181dcdf01b849a9664ba05fe0a2bc982fe"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	condition:
		uint16be( 0 ) == 0x4d5a and pe.imphash ( ) == "e43c58659b5b3082387307603478881a" or hash.md5 ( pe.rich_signature.clear_data ) == "d30bd7875b225709ecf95bf68dbd435f" or for any i in ( 0 .. pe.number_of_sections -1 ) : ( hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "d7d2079d0a656c06a03f2c277bb08bda" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "61a1425e6a0d28e29c6fd3d451ac3717" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "916bf96ed3274ce8322d9f370432844f" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "3fab9d4ae989d53cecb2f443b8ce88d0" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "e0967483e074da72ceff4dea3bc17530" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "b4a571736b6646765155ffbd57c27c83" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "35c88ba521887f8fe1b2501f8cd8bd98" ) or for any i in ( 0 .. pe.number_of_resources -1 ) : ( hash.sha256 ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) == "636dc666c7496cb3382b029fed53473f181cdc24405886c468e51a103d78b4d4" )
}