DITEKSHEN_MALWARE_Win_Smokeloader

rule DITEKSHEN_MALWARE_Win_Smokeloader : FILE
{
	meta:
		description = "Detects SmokeLoader variants"
		author = "ditekSHen"
		id = "e8f28f89-3a79-5d78-8c0a-bad16a57df84"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6516-L6539"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "65c56ed11a3cb4e4bcf8fd2a6be097545cb96e84ba4c4202969d1d163a2a36ed"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$x1 = "G2A/CLP/05/RYS" fullword wide
		$x2 = "0N1Y/53R10U5/BU51N355" fullword wide
		$x3 = "CH4PG3PB-6HT2VI9C-O2NL2NO5-QP1BW0EG" fullword wide
		$s1 = "Azure-Update-Task" fullword wide
		$s2 = "C:\\Windows\\System32\\schtasks.exe" fullword wide
		$s3 = "/C /create /F /sc minute /mo 1 /tn \"" fullword wide
		$s4 = "\\Microsoft\\Network" fullword wide
		$s5 = "\\Microsoft\\TelemetryServices" fullword wide
		$s6 = "\" /tr \"" fullword wide
		$e1 = "\\sqlcmd.exe" fullword wide
		$e2 = "\\sihost.exe" fullword wide
		$e3 = "\\fodhelper.exe" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $e* ) ) )
}