SEKOIA_Implant_Mac_Rustbucket

rule SEKOIA_Implant_Mac_Rustbucket : FILE
{
	meta:
		description = "Detect the RustBucket malware"
		author = "Sekoia.io"
		id = "fcbb745d-7f56-4c51-9db5-427da22a0c68"
		date = "2023-04-24"
		modified = "2024-12-19"
		reference = "https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/implant_mac_rustbucket.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747"
		logic_hash = "ab7bc706b0d3f0dcd739ffe7f8153ba7377892143d8d53ce1591519ffe4ae84f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "/Users/hero/"
		$ = "PATHIpv6Ipv4Bodyslotpath"
		$macho_magic = {CF FA ED FE}
		$java_magic = {CA FE BA BE}

	condition:
		($macho_magic at 0 or $java_magic at 0 ) and all of them
}