SEKOIA_Guloader_Powershell_1

rule SEKOIA_Guloader_Powershell_1 : FILE
{
	meta:
		description = "Powershell downloading decoy and delivering GuLoader"
		author = "Sekoia.io"
		id = "28c68991-db8b-4f00-b3a3-17286418a4ed"
		date = "2024-02-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/guloader_powershell_1.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "9fd2d0e31f939e7e96444eaa4802c9c33407c5fb77067670d8ce2d3796199961"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "powershell -win hidden"
		$s2 = "=iex($"
		$s3 = ".Replace('"
		$s4 = "$(Get-ChildItem -Include *.lnk -Name));"

	condition:
		all of them and filesize < 10KB and #s3 > 3
}