SEKOIA_Downloader_Win_Newsterminal

rule SEKOIA_Downloader_Win_Newsterminal : FILE
{
	meta:
		description = "Detect the PowerShell based downloader used by APT42 called NEWSTERMINAL"
		author = "Sekoia.io"
		id = "2f9aae45-e3bd-4d87-b336-5d141738952b"
		date = "2024-08-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/downloader_win_newsterminal.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "2b756515400d7e3b6e21ee3a83f313c8"
		logic_hash = "45c6c2b5b3723bf3ed46c82e6a254547d8c8b3446bb2fa4b4f0fc8441731ae7e"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "Start-Process -FilePath $takeownCommand -ArgumentList $takeownArgs -Wait -NoNewWindow"
		$ = "function Download-And-Extract-Dll {"
		$ = {24 69 63 61 63 6C 73 41 72 67 73 20 3D 20 24 64 65 73 74 69 6E 61 74 69 6F 6E 46 69 6C 65 50 61 74 68 2C 20 22 2F 67 72 61 6E 74 22 2C 20 22 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 73 3A 46 22 2C 20 22 2F 63 22 2C 20 22 2F 71 22}
		$ = "$publicip=(iwr http://127.0.0.1:4040/api/tunnels"

	condition:
		1 of them and filesize < 30KB
}