DITEKSHEN_MALWARE_Multi_Exaramel

rule DITEKSHEN_MALWARE_Multi_Exaramel : FILE
{
	meta:
		description = "Exaramel Windows/Linux backdoor payload"
		author = "ditekSHen"
		id = "014f10f3-4502-5719-93f6-4b2940f53876"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L420-L459"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e64383304bc913b07a2e63d61c81354b996c01171357005f4a28957d4d889599"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig1 = "MALWARE_Linux.Backdoor.Exaramel"
		clamav_sig2 = "MALWARE_Win.Backdoor.Exaramel"

	strings:
		$s1 = "vendor/golang_org/x/crypto/" ascii
		$s2 = "vendor/golang_org/x/net/http2" ascii
		$s3 = "vendor/golang_org/x/text/unicode" ascii
		$s4 = "vendor/golang_org/x/text/transform" ascii
		$s5 = "config.json" ascii
		$cmd1 = "App.Update" ascii
		$cmd2 = "App.Delete" ascii
		$cmd3 = "App.SetProxy" ascii
		$cmd4 = "App.SetServer" ascii
		$cmd5 = "App.SetTimeout" ascii
		$cmd6 = "IO.WriteFile" ascii
		$cmd7 = "IO.ReadFile" ascii
		$cmd8 = "OS.ShellExecute" ascii
		$cmd9 = "awk 'match($0, /(upstart|systemd|sysvinit)/){ print substr($0, RSTART, RLENGTH);exit;" ascii
		$ws1 = "/commands/@slp" wide
		$ws2 = "/commands/cmd" wide
		$ws3 = "/settings/proxy/@password" wide
		$ws4 = "/settings/servers/server[@current='true']" wide
		$ws5 = "/settings/servers/server/@current[text()='true']" wide
		$ws6 = "/settings/servers/server[text()='%s']/@current" wide
		$ws7 = "/settings/servers/server[%d]" wide
		$ws8 = "/settings/storage" wide
		$ws9 = "/settings/check" wide
		$ws10 = "/settings/interval" wide
		$ws11 = "report.txt" wide
		$ws12 = "stg%02d.cab" ascii
		$ws13 = "urlmon.dll" ascii
		$ws14 = "ReportDir" ascii

	condition:
		( uint16( 0 ) == 0x457f and ( all of ( $s* ) and 6 of ( $cmd* ) ) ) or ( uint16( 0 ) == 0x5a4d and 12 of ( $ws* ) )
}