SIGNATURE_BASE_MAL_Etoroloro_Malicious_Nodepackage_Dec25

rule SIGNATURE_BASE_MAL_Etoroloro_Malicious_Nodepackage_Dec25 : FILE
{
	meta:
		description = "Detects malicious component of node package named Etoroloro"
		author = "Pezier Pierre-Henri"
		id = "4c271502-68c6-5d20-85ea-c7f7628e417a"
		date = "2025-12-12"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_etoroloro_nodepackage_dec25.yar#L2-L27"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "f08c5b748c91dd45fd73c5e85920f656e361d94b869e2147410b2b528c6ae78f"
		logic_hash = "bd890359c38fb7f2af31390666691af70a202dcf352ef44e95493dc340c07e94"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "DLLSideload."
		$s2 = "Failed to expand path:" wide
		$op1 = {
         41 0f af c0           // imul    eax, r8d
         48 8d 52 01           // lea     rdx, [rdx+1]
         0f b6 c9              // movzx   ecx, cl
         45 69 c0 35 d4 04 00  // imul    r8d, 4D435h
         03 c1                 // add     eax, ecx
         0f b6 0a              // movzx   ecx, byte ptr [rdx]
         84 c9                 // test    cl, cl
         75 e5                 // jnz     short loc_1800022C0
      }

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or $op1 )
}