SEKOIA_Trojan_Win_Bbtok_Dll1_Sep23

rule SEKOIA_Trojan_Win_Bbtok_Dll1_Sep23 : FILE
{
	meta:
		description = "Finds BBTok installation DLL file"
		author = "Sekoia.io"
		id = "eebed24b-24ec-4a85-852c-52d0acc9a698"
		date = "2023-09-26"
		modified = "2024-12-19"
		reference = "https://research.checkpoint.com/2023/behind-the-scenes-of-bbtok-analyzing-a-bankers-server-side-components/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/trojan_win_bbtok_dll1_sep23.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "5353956345206982af9bde55300fc405ba6e40722e8f51e8717c30ad32bc8f91"
		logic_hash = "1b1e25f7d760d275d2ef01390c215edb1752ad65383c92a21d71d9e65da3c5f8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "C:\\Windows\\System32\\rundll32.exe" wide
		$str02 = "C:\\ProgramData\\mmd.exe" wide
		$str03 = "REG ADD HKCU\\Software\\Classes\\.pwn\\Shell\\Open\\command -ve /d" wide
		$str04 = "C:\\ProgramData\\mmd.exe \\\\" wide
		$str05 = "\\file\\Trammy.dll" wide
		$str06 = "Dacl & REG DELETE HKCU\\Software\\Classes\\ms-settings /f" wide
		$str07 = "REG DELETE  HKCU\\Software\\Classes\\.pwn /f" wide
		$str08 = "REG ADD HKCU\\Software\\Classes\\ms-settings\\CurVer -ve /d \".pwn\" /f" wide
		$str09 = "timeout /t 3 >nul & start /MIN computerdefaults.exe" wide
		$str10 = "set_StartInfo" ascii
		$str11 = "set_WindowStyle" ascii

	condition:
		uint16( 0 ) == 0x5a4d and 7 of them and filesize < 50KB
}