SIGNATURE_BASE_MAL_Minimalistic_Backdoor_May26

rule SIGNATURE_BASE_MAL_Minimalistic_Backdoor_May26 : FILE
{
	meta:
		description = "Detects minimalistic backdoor deployment where a shellcode loader downloads an encrypted payload and executes it in memory after RC4 decryption using a command-line provided key"
		author = "MalGamy"
		id = "8292161d-8b20-51e0-987a-dd0f4c1cf3e8"
		date = "2026-05-05"
		modified = "2026-05-15"
		reference = "https://securelist.com/tr/daemon-tools-backdoor/119654/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/threat_compromised_daemon_tools_lite_may26.yar#L68-L92"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "395ec7acd475a8acd358adc75c4615cf41737aed8a96c4f2dd792c8a6af4140c"
		logic_hash = "0f5e1f95d28fe5e45a10d652a11e9940823b4ac113dcf9b547f81d35bcda6cc7"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "Note: if multiple processes load the DLL," wide
		$x2 = "Inject (shellcode file is RC4 ciphertext; key is a UTF-8 string" wide
		$s1 = "Error: VirtualAllocEx failed, Win" wide
		$s2 = "Try running as administrator; " wide
		$s3 = ", shellcode size: " wide
		$s4 = "input file path cannot be empty." wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and ( 1 of ( $x* ) or all of ( $s* ) )
}