SEKOIA_Implant_Win_Lyceum

import "pe"
import "hash"

rule SEKOIA_Implant_Win_Lyceum : FILE
{
	meta:
		description = "Detect the DnsSystem malware used by Lyceum in March 2022"
		author = "Sekoia.io"
		id = "e061562f-9c17-4ef4-b7f9-2c6708bb6570"
		date = "2022-06-13"
		modified = "2024-12-19"
		reference = "https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/implant_win_lyceum.yar#L4-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "f6b4acf48877c1dd62fd2bfa19d701b0a79f052ec44fc5d4fe3dc7b02aa689c8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "$02c7afab-7f96-4dfa-b452-832e3624e270" ascii
		$ = "C:\\Users\\u1\\Downloads\\Compressed\\article_src\\DnsDig\\DnsDig\\obj\\Release\\DnsDig.pdb" ascii

	condition:
		uint16( 0 ) == 0x5A4D and 1 of them or for any i in ( 0 .. pe.number_of_sections -1 ) : ( hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "d0e0c140e4831f835bcdcc6b463f3acc" ) or for any i in ( 0 .. pe.number_of_resources -1 ) : ( hash.sha256 ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) == "22c92a1ba6ffd828637d7045261db7a45608ddd6d7c85836af011b3c679c725f" )
}