SEKOIA_Rootkit_Win_Purplefox_Kernel_Driver

import "pe"

rule SEKOIA_Rootkit_Win_Purplefox_Kernel_Driver : FILE
{
	meta:
		description = "Detect the Purple Fox trojan"
		author = "Sekoia.io"
		id = "798dc20b-76cd-4e31-b9ee-f363fb39cd58"
		date = "2022-03-28"
		modified = "2024-12-19"
		reference = "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal/IOCs-Purple-Fox.txt"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/rootkit_win_purplefox_kernel_driver.yar#L3-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "91d7caca7c0c41e70813d52b5662bf0238d078fca519bfc2c03f3f87fe3805b8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "\\DosDevices\\Global\\MyDriver" wide
		$ = "IOCTL_IO_KILL_PROCESS" ascii
		$ = "IOCTL_IO_DELET_FILE" ascii
		$ = "IOCTL_IO_COPY_FILE" ascii
		$ = "IOCTL_IO_KILL_MINIFITER" ascii

	condition:
		uint16( 0 ) == 0x5A4D and all of them or ( pe.rich_signature.toolid ( 171 , 30319 ) and pe.rich_signature.toolid ( 158 , 30319 ) and pe.rich_signature.toolid ( 170 , 30319 ) and pe.rich_signature.toolid ( 147 , 30729 ) and pe.rich_signature.toolid ( 1 , 0 ) ) and for any i in ( 0 .. pe.number_of_signatures -1 ) : ( pe.signatures [ i ] . thumbprint == "c7939f8303ca22effb28246e970b13bee6cb8043" )
}