DITEKSHEN_MALWARE_Win_Dllhijacker02

rule DITEKSHEN_MALWARE_Win_Dllhijacker02 : FILE
{
	meta:
		description = "Detects ServiceCrt / DllHijacker03 IronTiger / LuckyMouse / APT27 malware"
		author = "ditekSHen"
		id = "de5eee06-570a-5ec3-9e1b-13de4c4f260f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5512-L5527"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d4eb236256c413d4d3223cc897783f5631c7798c0f3280e72d8c8504438fcaf9"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "ServiceCrtMain" fullword ascii
		$s2 = "mpsvc.dll" fullword ascii
		$o1 = { 84 db 0f 85 4c ff ff ff e8 14 06 00 00 8b f0 83 }
		$o2 = { f7 c1 00 ff ff ff 75 c5 eb 13 0f ba 25 10 20 01 }
		$o3 = { 8d 04 b1 8b d9 89 45 fc 8d 34 b9 a1 18 20 01 10 }
		$o4 = { b0 01 c3 68 b8 2c 01 10 e8 83 ff ff ff c7 04 24 }
		$o5 = { eb 34 66 0f 12 0d 00 fe 00 10 f2 0f 59 c1 ba cc }
		$o6 = { 73 c7 dc 0d 4c ff 00 10 eb bf dd 05 34 ff 00 10 }

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 5 of ( $o* )
}