VOLEXITY_Apt_Malware_Golang_Brickstorm_B

rule VOLEXITY_Apt_Malware_Golang_Brickstorm_B : VERDANTBAMBOO BRICKSTORM FILE MEMORY
{
	meta:
		description = "Detection for the BRICKSTORM malware family."
		author = "threatintel@volexity.com"
		id = "b3b9ff26-56ab-5801-8905-0a304887b998"
		date = "2025-09-05"
		modified = "2026-06-09"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2026/2026-06-04 VerdantBamboo/rules.yar#L56-L98"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878"
		logic_hash = "e91203a714a4bc9d1c70eae4670681e3f416257163cf44db20ad33380be5d39a"
		score = 75
		quality = 80
		tags = "VERDANTBAMBOO, BRICKSTORM, FILE, MEMORY"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		report1 = "TIB-20251104"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 12299
		version = 6

	strings:
		$method1 = "UnPackHeaderData"
		$method2 = "handleRelay"
		$method3 = "NewWebSocketClient"
		$method4 = "createDnsMessage"
		$method5 = "GetFileOwnerInfo"
		$err1 = "dns rcode: %v"
		$err2 = "readFull error"
		$err3 = "tagAuth error"
		$err4 = "error: Auth: %s"
		$ws1 = "<a style='text-decoration: none;'  href='javascript:history.go(-1);'><h5>Back</h5></a>"
		$ws2 = "Mon, 02 Jan 2006 15:04:05 GMT"
		$doh = "https://1.0.0.1/dns-queryhttps://1.1.1.1/dns-queryhttps://8.8.4.4/dns-queryhttps://8.8.8.8/dns-query"

	condition:
		4 of ( $method* ) or 3 of ( $err* ) or all of ( $ws* ) or ( $doh and 3 of ( $method* , $err* , $ws* , $doh ) )
}