SEKOIA_Malware_Win_Passlib

rule SEKOIA_Malware_Win_Passlib : FILE
{
	meta:
		description = "Detect the Passlib malware"
		author = "Sekoia.io"
		id = "609999e2-a644-4bf3-bce2-b0e1b0e7094b"
		date = "2022-07-28"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/malware_win_passlib.yar#L1-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "5e76f7c40a00182ee076720b4c19a45e82a8ce11740fdd8e9419f9d9e93cdb41"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "Passlib test utility - Version %s" wide
		$ = "-l <full_path_to_dll_to_load_into_lsass> (arbitrary dll injection into LSASS)" wide
		$ = "-u <dll_to_unload_from_lsass> (arbitrary dll uninjection from LSASS)" wide
		$ = "DLL %s injection was successful requested!" wide
		$ = "DLL %s uninjection was successful requested!" wide
		$ = "Process %s was succesfully created with full privileges and system integrity!" wide
		$ = "full_path_to_volatile_payload_dll" wide
		$ = "%s: [%s]:[%s] (http_only:%d)" wide
		$ = "LEX server has been deployed at lsass." wide
		$ = "LEX client is using volatile payload at: %s" wide
		$ = "LEX client is using permanent payload at: %s" wide
		$ = "Passlib execution finished" wide
		$ = "Running on Passlib version %ws" wide
		$ = "There was a problem initializing passlib manager interface." wide
		$ = "Passlib running without high integrity" wide
		$ = "About to dump passwords through passlib manager interface" wide

	condition:
		uint16( 0 ) == 0x5A4D and filesize > 1500KB and all of them
}