SEKOIA_Rat_Win_Xworm_V3

rule SEKOIA_Rat_Win_Xworm_V3 : FILE
{
	meta:
		description = "Finds XWorm (version XClient, v3) samples based on characteristic strings"
		author = "Sekoia.io"
		id = "5fb1cbd3-1e37-43b9-9606-86d896f2150b"
		date = "2023-03-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/rat_win_xworm_v3.yar#L1-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "0016647c3c7031e744c0af6f9eadb73ab5cab1ca4f8ce7633f4aa069b62755cd"
		hash = "07e747a9313732d2dcf7609b6a09ac58d38f5643299440b827ec55f260e33c12"
		hash = "de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147"
		logic_hash = "9a50f41f6c295f48597f6db3f5d9141345b3711ef110a0f925c881f3a75580ca"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "$VB$Local_Port" ascii
		$str02 = "$VB$Local_Host" ascii
		$str03 = "get_Jpeg" ascii
		$str04 = "get_ServicePack" ascii
		$str05 = "Select * from AntivirusProduct" wide
		$str06 = "PCRestart" wide
		$str07 = "shutdown.exe /f /r /t 0" wide
		$str08 = "StopReport" wide
		$str09 = "StopDDos" wide
		$str10 = "sendPlugin" wide
		$str11 = "OfflineKeylogger Not Enabled" wide
		$str12 = "-ExecutionPolicy Bypass -File \"" wide
		$str13 = "Content-length: 5235" wide

	condition:
		uint16( 0 ) == 0x5A4D and 8 of them
}