SEKOIA_Launcher_Win_Mistcloak

import "pe"
import "hash"

rule SEKOIA_Launcher_Win_Mistcloak : FILE
{
	meta:
		description = "Detect the MISTCLOAK malware"
		author = "Sekoia.io"
		id = "3dbf5efa-d77c-436a-a080-9ac58a78425f"
		date = "2022-12-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/launcher_win_mistcloak.yar#L4-L33"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "fc2731ec4e2917be1ad169908ed324931a93f6998aee606319750b5cc02715e2"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "\\usb.ini"
		$ = "autorun.inf\\Protection for Autorun\\System Volume Information"
		$ = "G:\\project\\APT\\U"
		$ = "\\new\\u2ec\\Release\\u2ec.pdb"
		$ = "CheckUsbService"

	condition:
		uint16( 0 ) == 0x5A4D and 3 of them or hash.md5 ( pe.rich_signature.clear_data ) == "0f5082fd7ddd1950fa332a8fa4df052f" or for any i in ( 0 .. pe.number_of_sections -1 ) : ( hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "0ceac625db1e8405efe45d47486e9e2d" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "6968e6ac7b9c1dfbf40a0b3c4f6f4157" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "e6ed2da41f74e948cba7a002c41c6af5" )
}