BLACKBERRY_Windealer_Library

rule BLACKBERRY_Windealer_Library : FILE
{
	meta:
		description = "Detects WinDealer Loaded DLL"
		author = "BlackBerry Threat Research Team"
		id = "d7fbf21b-9144-532a-ad5d-29543f0ffc33"
		date = "2022-06-14"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malwareZ"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Windealer_Library.yar#L1-L26"
		license_url = "N/A"
		logic_hash = "35151a8c0486ceaddb5020cb81f644bba4b01d5f8e4726786abc65ae92ca9c3e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

	strings:
		$s1 = "C:\\Users\\Public\\Documents\\Tencent\\QQ\\UserDataInfo.ini"
		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders"
		$s3 = "SOFTWARE\\SogouInput\\red"
		$s4 = "SOFTWARE\\SogouDesktopBar"
		$s5 = "MozillaDll.dll"
		$s6 = "Tencent Files"
		$s7 = "wangwang"
		$s8 = "WeChat Files"
		$s9 = "MyDocument"
		$s10 = "Skype"
		$e1 = "AutoGetSystemInfo"
		$e2 = "GetConfigInfo"
		$e3 = "partInitOpt"

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}