SEKOIA_Tool_Win_Driverjack

rule SEKOIA_Tool_Win_Driverjack : FILE
{
	meta:
		description = "No description has been set in the source file - SEKOIA"
		author = "Sekoia.io"
		id = "08bc0fe8-38f1-4c73-99c8-2659b4a55815"
		date = "2024-09-11"
		modified = "2024-12-19"
		reference = "https://github.com/klezVirus/DriverJack/blob/master/DriverJack"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_win_driverjack.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "649fc12915bdcdebbc3798a8ad0b9b32"
		logic_hash = "0ea81c32b75ff66434f0c949be7d1478ce9268eb1b67dc5b7d6c7604cedcd72c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "(*) Decrypting %llu bytes of file content using key '%s' of length %u..."
		$ = "(*) Modifying file %s in mapped drive..."
		$ = "(*) Checking file %s in mapped drive..."
		$ = "(-) CreateProcess failed '%s' (%08x)."
		$ = "(*) Mounted Drive Letter: %s"

	condition:
		uint16be( 0 ) == 0x4d5a and all of them
}