SIGNATURE_BASE_MAL_Go_Modbus_Jul24_1

rule SIGNATURE_BASE_MAL_Go_Modbus_Jul24_1 : FILE
{
	meta:
		description = "Detects characteristics reported by Dragos for FrostyGoop ICS malware"
		author = "Florian Roth"
		id = "4a1e6bbe-d743-5394-b207-e417b64fa76d"
		date = "2024-07-23"
		modified = "2024-07-24"
		reference = "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_go_modbus.yar#L2-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb"
		logic_hash = "d992c8159deca0ed2b2a33da3c31fdf0efa9a09ba941d059fa7fc1bad458aed1"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$a1 = "Go build"
		$sa1 = "github.com/rolfl/modbus"
		$sb1 = "main.TaskList.executeCommand"
		$sb2 = "main.TargetList.getTargetIpList"
		$sb3 = "main.TaskList.getTaskIpList"
		$sb4 = "main.CycleInfo" fullword

	condition:
		filesize < 30MB and ( $sa1 and 3 of ( $sb* ) ) or 4 of them
}