SEKOIA_Apt_Lazarus_Vhd_Ransomware_Loader

rule SEKOIA_Apt_Lazarus_Vhd_Ransomware_Loader : FILE
{
	meta:
		description = "Detects VHD ransomware x64 loader "
		author = "Sekoia.io"
		id = "377f3ec5-fa2a-431e-93d2-6a1eb9e01d28"
		date = "2022-11-28"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_lazarus_vhd_ransomware_loader.yar#L1-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "33000fd79b5aae59dcbf445bb4d0d65cf5f939f376a4e3d9e23e14b11ca297da"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = { B8 64 [8] B8 75 [8] B8 6D [8] B8 70 [8] B8 2E [8] B8 62 [8] B8 69 [8] B8 6E }
		$ = { 48 63 ?? ?? ??
        48 8B ?? ?? ??
        0F BE ?? ??
        B9 ?? ?? ?? ??
        48 6B ?? ??
        48 8B ?? ?? ??
        0F BE ?? ??
        ?? ??
        48 63 ?? ?? ??
        48 8B ?? ?? ??
        88 ?? ??
        EB }
		$ = { 25 00 73 00 5c [3-15] 25 00 64 00 25 00 64 00 2e 00 62 00 69 00 6e }

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 200KB and 2 of them
}