SEKOIA_Loader_Win_Konni_Bat

rule SEKOIA_Loader_Win_Konni_Bat : FILE
{
	meta:
		description = "Detect the BAT files (named trap.bat or yup.bat) used by KONNI"
		author = "Sekoia.io"
		id = "e8921336-6c91-4b46-bd3f-3cf4a9b31082"
		date = "2023-09-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_win_konni_bat.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "3476e41461692c3ccfc0ef47a4d5b8822c4940987755763d2a5913e27d9350d4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "del /f /q \"%~dp0\\*.zip\" > nul"
		$ = "del /f /q \"%~dp0\\*.xml\" > nul"
		$ = "del /f /q \"%~dp0\\wpnprv*.dll\" > nul"
		$ = "del /f /q \"%~dp0\\*.bat\" > nul"
		$ = "del /f /q \"%~dpnx0\" > nul"
		$ = "echo %~dp0 | findstr /i \"system32\" > nul"
		$ = "if %ERRORLEVEL% equ 0 (goto INSTALL) else (goto COPYFILE)"
		$ = "if exist \"%ProgramFiles(x86)%\" ("

	condition:
		3 of them and filesize < 3KB
}