SEKOIA_Tool_Swor

rule SEKOIA_Tool_Swor : FILE
{
	meta:
		description = "Detects swor"
		author = "Sekoia.io"
		id = "75ce2ed7-2972-4e04-98dc-451acf80c842"
		date = "2024-09-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_swor.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "d3f92b3349109fc6de26f5e40800fec15308c27fa4fe81fe42af5030637a3a63"
		logic_hash = "bcd1c0afece740b82b606aad8bdebcc88b72ae61df6513318215a217021efab4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$old_sword_s1 = "Failed to open payload file: "
		$old_sword_s2 = "Failed to open config file: "
		$sword_s1 = "open encrypted file error: "
		$sword_s2 = "open config file error: "
		$enum_calendar = "EnumCalendarInfo"

	condition:
		uint16be( 0 ) == 0x4d5a and $enum_calendar and ( 2 of ( $old_sword_s* ) or 2 of ( $sword_s* ) ) and filesize < 1MB and true
}