SEKOIA_Loader_Win_Erbium

rule SEKOIA_Loader_Win_Erbium : FILE
{
	meta:
		description = "Detect the Erbium loader based on specific user-agent and URI"
		author = "Sekoia.io"
		id = "d1e5be62-5677-4ef4-9f10-65baf36ab619"
		date = "2022-09-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_win_erbium.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "e93e9dbf0e5412afa4640b4cf5d94374c4df38f8044d44c375e86508c0d4190a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36" wide
		$str02 = "cloud/getHost.php?method=getstub&bid=" wide
		$str03 = "api.php?method=getstub&bid=" wide
		$api = "WinHttp" ascii

	condition:
		uint16( 0 ) == 0x5A4D and 2 of ( $str* ) and #api > 6
}