SEKOIA_Rat_Win_Dcrat_Qwqdanchun

rule SEKOIA_Rat_Win_Dcrat_Qwqdanchun : FILE
{
	meta:
		description = "Find DcRAT samples (qwqdanchun) based on specific strings"
		author = "Sekoia.io"
		id = "8206a410-48b3-425f-9dcb-7a528673a37a"
		date = "2023-01-26"
		modified = "2024-12-19"
		reference = "https://github.com/qwqdanchun/DcRat"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/rat_win_dcrat_qwqdanchun.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "e6f8664e57ecce3bd7b2af5c67d564d526b32d12218b772b0e9f53709044e14d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "DcRatByqwqdanchun" wide
		$str02 = "U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==" wide
		$str03 = "Po_ng" wide
		$str04 = "Pac_ket" wide
		$str05 = "Perfor_mance" wide
		$str06 = "Install_ed" wide
		$str07 = "get_IsConnected" ascii
		$str08 = "get_ActivatePo_ng" ascii
		$str09 = "isVM_by_wim_temper" ascii
		$str10 = "save_Plugin" wide
		$str11 = "timeout 3 > NUL" wide
		$str12 = "ProcessHacker.exe" wide
		$str13 = "Select * from Win32_CacheMemory" wide

	condition:
		uint16( 0 ) == 0x5A4D and 8 of them
}