FIREEYE_RT_Dropper_LNK_Lnksmasher_1

rule FIREEYE_RT_Dropper_LNK_Lnksmasher_1 : FILE
{
	meta:
		description = "The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID."
		author = "FireEye"
		id = "1b93ddf8-9578-5e47-b479-4c9e8a40b4f4"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LNKSMASHER/production/yara/Dropper_LNK_LNKSmasher_1.yar#L4-L18"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "0a86d64c3b25aa45428e94b6e0be3e08"
		logic_hash = "61d1ac67ac0d332ad842a522cbebe1b9af1482d58a210b50fb45209355c0aeeb"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 6

	strings:
		$drive_serial = { 12 F7 26 BE }
		$file_droid_guid = { BC 96 28 4F 0A 46 54 42 81 B8 9F 48 64 D7 E9 A5 }
		$guid_clsid = { E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D }
		$header = { 4C 00 00 00 01 14 02 }

	condition:
		$header at 0 and all of them
}