VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23

rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 : EVILBAMBOO FILE
{
	meta:
		description = "Detection of the second stage capability of the BadBazaar android malware that has the main malicious capabilities. Will gather various info about the user/phone and routinely send this to the C2."
		author = "threatintel@volexity.com"
		id = "1f97c610-773f-5385-935a-445cb9192157"
		date = "2023-05-25"
		modified = "2023-08-30"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L257-L285"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "bf5f7fbf42236e89bcf663d2822d54bee89abaf3f247a54f371bf156e0e03629"
		logic_hash = "2186369298ebfa0b892ecb14ebacc93c6d14c9c35012e8e6cdff077634cf3773"
		score = 75
		quality = 80
		tags = "EVILBAMBOO, FILE"
		scan_context = "file"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"

	strings:
		$c1 = "%{\"command\":\"%s\",\"path\":\"%s\",\"files\":["
		$c2 = "{\"name\":\"%s\",\"dirs\":\"%d\",\"files\":\"%d\",\"isfolder\":\"%d\",\"path\":\"%s\"},"
		$s1 = "Timezon id:"
		$s2 = "China Telecom"
		$s3 = "China Unicom"
		$s4 = "ConfigPipe"
		$s5 = "ForwordTo"
		$s6 = "can't get camera content"
		$s7 = "cat /sys/class/net/wlan0/address"
		$s8 = "_preferences_light"
		$s9 = "registration_jid"

	condition:
		1 of ( $c* ) or 5 of ( $s* )
}