DITEKSHEN_MALWARE_Win_Bandook

rule DITEKSHEN_MALWARE_Win_Bandook : FILE
{
	meta:
		description = "Detects Bandook backdoor"
		author = "ditekshen"
		id = "c74bd688-c79e-5939-93a8-c2cd9f2cd60e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2676-L2705"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bff09f769aae890d81efe9926cc8ce85c1caa4eeeb6bc7d2321d2d906ac8d6cf"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Bandook"

	strings:
		$s1 = "\"%sLib\\dpx.pyc\" \"%ws\" \"%ws\" \"%ws\" \"%ws\" \"%ws\"" fullword wide
		$s2 = "%s\\usd\\dv-%s.dat" fullword ascii
		$s3 = "%sprd.dat" fullword ascii
		$s4 = "%sfile\\shell\\open\\command" fullword ascii
		$s5 = "explorer.exe , %s" fullword ascii
		$f1 = "CaptureScreen" fullword ascii
		$f2 = "StartShell" fullword ascii
		$f3 = "ClearCred" fullword ascii
		$f4 = "GrabFileFromDevice" fullword ascii
		$f5 = "PutFileOnDevice" fullword ascii
		$f6 = "ChromeInject" fullword ascii
		$f7 = "StartFileMonitor" fullword ascii
		$f8 = "DisableMouseCapture" fullword ascii
		$f9 = "StealUSB" fullword ascii
		$f10 = "DDOSON" fullword ascii
		$f11 = "InstallMac" fullword ascii
		$f12 = "SendCam" fullword ascii
		$x1 = "RTC-TGUBP" fullword ascii
		$x2 = "AVE_MARIA" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 6 of ( $f* ) or ( 2 of ( $s* ) and 3 of ( $f* ) ) or ( all of ( $x* ) and ( 2 of ( $f* ) or 3 of ( $s* ) ) ) )
}