VOLEXITY_Apt_Malware_Win_Pocostick_Jul23

rule VOLEXITY_Apt_Malware_Win_Pocostick_Jul23 : STORMBAMBOO FILE MEMORY
{
	meta:
		description = "Detects the July 2023 POCOSTICK variant. These strings are only visible in memory after several rounds of shellcode decryption."
		author = "threatintel@volexity.com"
		id = "9632a7fc-06da-58b4-b95c-b46aeb9dd41d"
		date = "2023-07-24"
		modified = "2024-08-02"
		reference = "TIB-20231221"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2024/2024-08-02 StormBamboo/rules.yar#L206-L235"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "ec3e787c369ac4b28447e7cacc44d70a595e39d47f842bacb07d19b12cab6aad"
		logic_hash = "19487db733c7f793be2a1287df32a165e46f6af0e940b13b389f4d675b5100c4"
		score = 75
		quality = 80
		tags = "STORMBAMBOO, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9542
		version = 3

	strings:
		$str1 = "Folder PATH listing form volume" wide
		$str2 = "Volume serial number is 0000-1111" wide
		$str3 = "Type:Error" wide
		$str4 = "Type:Desktop" wide
		$str5 = "Type:Laptop" wide
		$str6 = "Type:Vitual" wide
		$str7 = ".unicode.tmp" wide
		$str8 = "EveryOne" wide

	condition:
		6 of them
}