SEKOIA_Tool_Pchunter_And_Related_Certificate

import "pe"

rule SEKOIA_Tool_Pchunter_And_Related_Certificate : FILE
{
	meta:
		description = "Detects PCHunter and associated binairies & drivers"
		author = "Sekoia.io"
		id = "757c7738-4ee8-4b4e-bdda-0c5b0c010f40"
		date = "2022-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_pchunter_and_related_certificate.yar#L3-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "924a85b2eaec73b628e705b3bb2e464582a71c19317d2023b1422b1b8ad97a51"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	condition:
		uint16be( 0 ) == 0x4d5a and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . serial contains "05:51:bc:8c:6a:a2:ca:03:2b:c6:71:38:30:d8:49:a3" ) and filesize > 400KB and filesize < 20MB
}