SEKOIA_Rat_Win_Asbit

rule SEKOIA_Rat_Win_Asbit : FILE
{
	meta:
		description = "Finds Asbit samples based on characteristic strings"
		author = "Sekoia.io"
		id = "b2d60eff-3dc8-4857-a0ea-d4fcd34c40bc"
		date = "2022-09-19"
		modified = "2024-12-19"
		reference = "https://blogs.juniper.net/en-us/threat-research/asbit-an-emerging-remote-desktop-trojan"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/rat_win_asbit.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "1362ebe89a4d2645eb687d92510daa355a16f05da7f5513817f8439f29722827"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "/build?project=libexpat&_={0}" wide
		$str02 = "/resolve?name={0}&short=true&_={1}" wide
		$str03 = "/c ping 127.0.0.1 & del {0} /q & del /a:H {0} /q" wide

	condition:
		uint16( 0 ) == 0x5A4D and 1 of them
}