SEKOIA_Hacktool_Mimilite

rule SEKOIA_Hacktool_Mimilite : FILE
{
	meta:
		description = "Detects Mimilite"
		author = "Sekoia.io"
		id = "abb92a9d-0978-4ef2-b2cc-53ce6e83e3e4"
		date = "2023-12-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/hacktool_mimilite.yar#L1-L37"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "504bc58e1c4143cc2322d564b637b0e014a4ead44f56a75fe1202b0d0a2e8bbc"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$chunk = {
        FF C7
        48 63 D7
        46 0F B6 04 22
        41 03 F0
        81 E6 ?? ?? ?? ??
        7D ??
        FF CE
        81 CE ?? ?? ?? ??
        FF C6
        48 63 CE
        42 0F B6 04 21
        42 88 04 22
        46 88 04 21 }
		$imp1 = "CryptGetHashParam"
		$imp2 = "CryptDestroyHash"
		$imp3 = "CryptHashData"
		$imp4 = "CryptReleaseContext"
		$imp5 = "CryptCreateHash"
		$imp6 = "CryptAcquireContextA"
		$imp7 = "VirtualAlloc"

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 200KB and all of ( $imp* ) and $chunk
}