SEKOIA_Apt_Muddywater_Moriagent

import "pe"

rule SEKOIA_Apt_Muddywater_Moriagent : FILE
{
	meta:
		description = "Detects Muddy's Mori Agent implant"
		author = "Sekoia.io"
		id = "e7a83663-6a30-416a-8f29-87a6b9445ea4"
		date = "2022-01-14"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_muddywater_moriagent.yar#L3-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "21389d4e71e9a19a9d263b8ced740c337ea88ed4ac97199897b0aa3f5914594a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$mut = "0x50504060" ascii fullword
		$cmd1 = "TType" ascii fullword
		$cmd2 = "TPath" ascii fullword
		$cmd3 = "TFileid" ascii fullword
		$cmd4 = "TCommand" ascii fullword
		$cmd5 = "TTimeout" ascii fullword
		$cmd6 = "TFilter" ascii fullword

	condition:
		uint16be( 0 ) == 0x4d5a and ( ( pe.number_of_exports == 2 and pe.exports ( "DllRegisterServer" ) and pe.exports ( "DllUnregisterServer" ) ) and ( 5 of them ) )
}