SEKOIA_Launcher_Win_Bluehaze

import "pe"
import "hash"

rule SEKOIA_Launcher_Win_Bluehaze : FILE
{
	meta:
		description = "Detect the BLUEHAZE malware"
		author = "Sekoia.io"
		id = "ccfe0593-0a9f-4369-952e-5cef2f459bb3"
		date = "2022-12-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/launcher_win_bluehaze.yar#L4-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "56a9d6d713a5744e77c8d34ad28983bb3b2aded1abff47dbf2d887724bd3ed4e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "Libraries\\CNNUDTV"
		$ = "cmd.exe /C wuwebv.exe -t -e"
		$ = "cmd.exe /C reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ACNTV /t REG_SZ /d \"Rundll32.exe SHELL32.DLL,ShellExec_RunDLL"

	condition:
		uint16( 0 ) == 0x5A4D and 3 of them or pe.imphash ( ) == "1b3d8fae6035e34f91baa59643746efe" or hash.md5 ( pe.rich_signature.clear_data ) == "44022b7cefeae4d55edcceb5b9bcd295" or for any i in ( 0 .. pe.number_of_sections -1 ) : ( hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "1cdcb493593f8793b10e109f6b5b2993" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "276d668ed7d1b46e101425e02a16460f" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "f6a474220add335b5696256235ce8c9c" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "82bccb3330d50080f86ab1aa566cae8e" )
}