DITEKSHEN_MALWARE_Win_Dlagent06

rule DITEKSHEN_MALWARE_Win_Dlagent06 : FILE
{
	meta:
		description = "Detects known downloader agent downloading encoded binaries in patches"
		author = "ditekSHen"
		id = "00cb5184-b12d-5014-bee8-116cc72dfa47"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4593-L4610"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9188804ad0e08f3e0cd09eb8815abea14da5aa28aef9084d19108a24f49f65c7"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920122"
		snort3_sid = "920119"

	strings:
		$s1 = "totallist" fullword ascii wide
		$s2 = "LINKS_HERE" fullword wide
		$s3 = "[SPLITTER]" fullword wide
		$var2_1 = "DownloadWeb" fullword ascii
		$var2_2 = "WriteByte" fullword ascii
		$var2_3 = "MemoryStream" fullword ascii
		$var2_4 = "DownloadString" fullword ascii
		$var2_5 = "WebClient" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 2 of ( $var2* ) ) or ( 4 of ( $var2* ) and 2 of ( $s* ) ) )
}