SEKOIA_Loader_Latrodectus_Dll

rule SEKOIA_Loader_Latrodectus_Dll : FILE
{
	meta:
		description = "Finds Latrodectus samples based on the specific strings"
		author = "Sekoia.io"
		id = "c60676ad-31cb-4f4d-9073-757a0ad7d23d"
		date = "2023-12-08"
		modified = "2024-12-19"
		reference = "https://twitter.com/Myrtus0x0/status/1732997981866209550"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_latrodectus_dll.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "57aae1944eded14537cdc1c17b21cfc503687a416551b782fc76f8c7858e936e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "c:\\temp\\debug.pdb" fullword ascii
		$str02 = "Bottmp64.dll" fullword ascii
		$str03 = "scab" fullword ascii
		$str04 = "&wmic=" fullword ascii
		$str05 = "&ipconfig=" fullword ascii
		$str06 = "&systeminfo=" fullword ascii
		$str07 = "&domain_trusts=" fullword ascii
		$str08 = "&domain_trusts_all=" fullword ascii
		$str09 = "&net_view_all_domain=" fullword ascii
		$str10 = "&net_view_all=" fullword ascii
		$str11 = "&net_group=" fullword ascii
		$str12 = "&net_config_ws=" fullword ascii
		$str13 = "&net_wmic_av=" fullword ascii
		$str14 = "&whoami_group=" fullword ascii
		$str15 = "\"subproc\": [" fullword ascii
		$str16 = "&proclist=[" fullword ascii
		$str17 = "&desklinks=[" fullword ascii
		$str18 = "Update_%x" fullword wide
		$str19 = "Custom_update" fullword wide
		$str20 = "\\update_data.dat" fullword wide

	condition:
		uint16( 0 ) == 0x5A4D and 10 of them
}