SEKOIA_Rat_Win_Arrow_Str

rule SEKOIA_Rat_Win_Arrow_Str : FILE
{
	meta:
		description = "Finds Arrow RAT samples based on the specific malware strings"
		author = "Sekoia.io"
		id = "69f6572c-91ed-4fb6-b886-5ad2dabef3d3"
		date = "2022-08-19"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/rat_win_arrow_str.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "faf66a14e563066bb86ceadc787c092a5a13a43f936f0d9d19fbe7d4352ea5d8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$hvnc01 = "DESKTOP_JOURNALRECORD" ascii
		$hvnc02 = "DESKTOP_ENUMERATE" ascii
		$hvnc03 = "DESKTOP_SWITCHDESKTOP" ascii
		$hvnc04 = "DESKTOP_CREATEWINDOW" ascii
		$hvnc05 = "StartHVNC" ascii
		$str01 = "U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c" wide
		$str02 = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath" wide
		$str03 = "cvtres.exe" wide
		$str04 = "qbkTHriRRbQjaArtJfF" wide
		$str05 = "29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb24=" wide
		$str06 = "Stub.exe" ascii wide
		$str07 = "DePikoloData" ascii

	condition:
		uint16be( 0 ) == 0x4d5a and 4 of ( $hvnc* ) and 5 of ( $str* )
}