SEKOIA_Rat_Win_Xworm_V2

rule SEKOIA_Rat_Win_Xworm_V2 : FILE
{
	meta:
		description = "Finds XWorm v2 samples based on characteristic strings"
		author = "Sekoia.io"
		id = "6cf06f52-0337-415d-8f29-f63d67e228f8"
		date = "2022-11-07"
		modified = "2024-12-19"
		reference = "https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/rat_win_xworm_v2.yar#L1-L38"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "58a2dbfbd453855021942902a6d55d150eee3acba67a294da24448cfca4f811e"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "XWorm.exe" wide ascii
		$str02 = "ngrok" wide ascii
		$str03 = "Mutexx" ascii
		$str04 = "FileManagerSplitFileManagerSplit" wide
		$str05 = "InstallngC" wide
		$str06 = "downloadedfile" wide
		$str07 = "creatfile" wide
		$str08 = "creatnewfolder" wide
		$str09 = "showfolderfile" wide
		$str10 = "hidefolderfile" wide
		$str11 = "txtttt" wide
		$str12 = "\\root\\SecurityCenter2" wide
		$str13 = "[USB]" wide
		$str14 = "[Drive]" wide
		$str15 = "[Folder]" wide
		$str16 = "HVNC" wide
		$str17 = "http://exmple.com/Uploader.php" wide
		$str18 = "XKlog.txt" wide
		$str19 = "Select * from AntivirusProduct" wide
		$str20 = "runnnnnn" wide
		$str21 = "RunBotKiller" wide
		$str22 = "bypss" wide
		$str23 = "<Xwormmm>" wide

	condition:
		uint16( 0 ) == 0x5A4D and 12 of them
}