SEKOIA_Evilnumpayload_Fmtstr

rule SEKOIA_Evilnumpayload_Fmtstr
{
	meta:
		description = "Detect payload of EvilNum"
		author = "Sekoia.io"
		id = "980c58e4-e04d-4076-a92e-2c04ced19ece"
		date = "2022-07-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/evilnumpayload_fmtstr.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "7aa55d0677e58658bb76a2d7386a7434011b5f9b8c9de1b718c37f85907ddcc3"
		score = 75
		quality = 80
		tags = ""
		version = "1.1"
		classification = "TLP:CLEAR"

	strings:
		$fmtstr01 = "{\"v\":\"" ascii wide
		$fmtstr02 = ",\"u\":\"" ascii wide
		$fmtstr03 = ",\"a\":\"" ascii wide
		$fmtstr04 = ",\"w\":\"" ascii wide
		$fmtstr05 = ",\"d\":\"" ascii wide
		$fmtstr06 = ",\"n\":\"" ascii wide
		$fmtstr07 = ",\"r\":\"1\"" ascii wide
		$fmtstr08 = ",\"r\":\"0\"" ascii wide
		$fmtstr09 = ",\"xn\":\"" ascii wide
		$fmtstr10 = ",\"s\":0}" ascii wide
		$fmtstr11 = "{\"u\":\"" ascii wide
		$fmtstr12 = "\",\"sc\":1" ascii wide
		$fmtstr13 = ",\"dt\":\"" ascii wide

	condition:
		8 of ( $fmtstr* )
}