DITEKSHEN_MALWARE_Win_Itranslatordll

rule DITEKSHEN_MALWARE_Win_Itranslatordll : FILE
{
	meta:
		description = "Detects iTranslator DLL payload"
		author = "ditekSHen"
		id = "df05da78-3626-5eb5-81a2-a93fba844484"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2876-L2892"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ca0479efd241058f358553b6382a1987a5b4c069965f4adb88cd2f3fc4bef21a"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.iTranslator_DLL"

	strings:
		$d1 = "system32\\drivers\\%S.sys" fullword wide
		$d2 = "\\windows\\system32\\winlogon.exe" fullword ascii
		$d3 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\%s" fullword wide
		$d4 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\webssx" fullword wide
		$d5 = "\\Device\\CtrlSM" fullword wide
		$d6 = "\\DosDevices\\CtrlSM" fullword wide
		$d7 = "\\driver_wfp\\CbFlt\\Bin\\CbFlt.pdb" ascii
		$d8 = ".php" ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}