SEKOIA_Apt_Aptk47_Maliciouslnk

rule SEKOIA_Apt_Aptk47_Maliciouslnk : FILE
{
	meta:
		description = "Detects APT-K-47 malicious LNK"
		author = "Sekoia.io"
		id = "2ccc8777-26fe-4018-9646-4ea91394fe78"
		date = "2024-11-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_aptk47_maliciouslnk.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "6a405d4e88b4acb9706e19a83aad9cf6"
		logic_hash = "865bb08f57affb3795853aa3c9f49577efb74df9b32e7760263b9fb08246a3ab"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "[/c for /f" wide
		$ = "2^>nul') do copy" wide
		$ = "%F in ('where /r %Temp%" wide

	condition:
		uint32be( 0 ) == 0x4c000000 and all of them
}