SEKOIA_Guerrilla_Lemongroup

rule SEKOIA_Guerrilla_Lemongroup : FILE
{
	meta:
		description = "No description has been set in the source file - SEKOIA"
		author = "Sekoia.io"
		id = "df635b5a-a19a-48ab-9a3a-9723e265c71d"
		date = "2023-05-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/guerrilla_lemongroup.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "b644cb537a42217f2549f37bfe07ae0b7ba39fc248ab3d5fd870384c7684683b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$dex = { 64 65 78 0A 30 33 ?? 00 }
		$odex = { 64 65 79 0A 30 33 ?? 00 }
		$s2 = "data response code===" ascii
		$s3 = "httpCon:" ascii
		$s4 = "processName :" ascii
		$s5 = "startListTasks......" ascii
		$s6 = "url==" ascii
		$s7 = "java core run ZYGOTE_PROCESS" ascii
		$api1 = "/api.php" ascii
		$api2 = "/event.php" ascii
		$api3 = "/apiRS.php" ascii

	condition:
		($dex at 0 or $odex at 0 ) and filesize > 100KB and filesize < 5MB and 5 of ( $s* ) and 1 of ( $api* )
}