SEKOIA_Loader_Win_Goshellcode

rule SEKOIA_Loader_Win_Goshellcode : FILE
{
	meta:
		description = "Finds GoShellcode samples based on the specific strings"
		author = "Sekoia.io"
		id = "61346225-325a-4067-a4d6-3b8c001dd380"
		date = "2023-11-15"
		modified = "2024-12-19"
		reference = "https://github.com/yoda66/GoShellcode/blob/main/gosc.go"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_win_goshellcode.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "94445af999055bf7d7cddc0d1d5183ab2776d85285f0522a28fac6c5a6101906"
		hash = "fdea8b01b2597ceafe6f08b5fd12cc603b1e3ce2037731c0b6defde6935b1ce0"
		logic_hash = "48ec87f284fbd14cbdb6b6b0f2e0fa6eb5ea19f112648660e0b8e525c562e3fc"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "main.VirtualAlloc" ascii
		$str02 = "main.RtlMoveMemory" ascii
		$str03 = "syscall.Syscall" ascii
		$str04 = "syscall.NewLazyDLL" ascii
		$str05 = "runtime.getGetProcAddress" ascii
		$str06 = "runtime.useAeshash" ascii

	condition:
		uint16( 0 ) == 0x5A4D and all of ( $str* ) and filesize < 8MB
}