VOLEXITY_Apt_Malware_Golang_Govershell_Strings_UTA0388

rule VOLEXITY_Apt_Malware_Golang_Govershell_Strings_UTA0388 : UTA0388 FILE MEMORY
{
	meta:
		description = "This rule detects multiple variants of the GOVERSHELL malware family employed by UTA0388 via unique strings. The implant is side-loaded by a legitimate executable and uses various network protocol to communicate with the C2 server."
		author = "threatintel@volexity.com"
		id = "1fe9b2b8-5c74-5d3c-954b-37f625911f75"
		date = "2025-06-30"
		modified = "2025-10-08"
		reference = "TIB-20250708B"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2025/2025-10-08 UTA0388/rules.yar#L74-L134"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "a5ee55a78d420dbba6dec0b87ffd7ad6252628fd4130ed4b1531ede960706d2d"
		hash = "fbade9d8a040ed643b68e25e19cba9562d2bd3c51d38693fe4be72e01da39861"
		logic_hash = "74fa940002e0af9095790b1cf7260778661c97db4e3d316183eecde0e2b580a8"
		score = 75
		quality = 78
		tags = "UTA0388, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		report2 = "MAR-20250930"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 11993
		version = 10

	strings:
		$a1 = "/lib/te64/"
		$a2 = "te64/payload."
		$a3 = "payload.sendAuthRequest.Println.func1"
		$a4 = "sendAuthRequest.deferwrap"
		$a5 = ".ensureSingleInstance.Printf."
		$a6 = "httpslike.NewHttpsLikeConn"
		$a7 = "main.Execute.Println."
		$a8 = "C:/Users/Dev/Desktop/20250608"
		$a9 = "/lib/te64/httpslike/httpslike.go"
		$a10 = "/lib/te64/payload/payload.go"
		$a11 = "/lib/te64/main.go"
		$a12 = "'rootFolderObj"
		$a13 = "'triggersObj"
		$a14 = "'repetitionObj"
		$a15 = "httpslike"
		$a16 = "main.CopySelf.copyDir."
		$s1 = "C:/Users/Make/Downloads/te250608/lib/te64/payload"
		$s2 = "te64/payload."
		$s3 = "C:/Users/Make/Desktop/lib/"
		$s4 = "CreateUserTask.deferwrap"
		$s5 = "main.generateRandomDir"
		$s6 = "te64.dll"
		$s7 = "payload.NewHttpClient.ProxyURL."
		$s8 = "payload.normalizeProxyURL"
		$b1 = {27 70 72 6f 67 72 61 6d 44 61 74 61 00}
		$b2 = {27 72 61 6e 64 6f 6d 44 69 72 00}
		$b3 = {27 74 61 72 67 65 74 44 69 72 00}
		$b4 = {27 65 78 65 50 61 74 68 00}
		$b5 = {27 63 75 72 72 65 6e 74 44 69 72 00}
		$b6 = {27 65 78 65 4e 61 6d 65 00}
		$b7 = {27 74 61 72 67 65 74 45 78 65 00}
		$b8 = {27 72 65 6c 50 61 74 68 00}

	condition:
		4 of ( $a* ) or 5 of ( $s* ) or 3 of ( $b* )
}