VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Uevent_Seqnum

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Uevent_Seqnum : TRANSPARENTJASMINE FILE
{
	meta:
		description = "Detects a script deployed as part of DISGOMOJI malware chain."
		author = "threatintel@volexity.com"
		id = "9df61164-6a92-5042-ba4f-64dc7e998283"
		date = "2024-03-07"
		modified = "2024-07-05"
		reference = "TIB-20240318"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L160-L187"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "98b24fb7aaaece7556aea2269b4e908dd79ff332ddaa5111caec49123840f364"
		logic_hash = "e390e83d9fc15499c9f32ad47d1c526273105602bda7b3532720b0a3f6abc835"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE"
		os = "linux"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10314
		version = 6

	strings:
		$s1 = "USB_DIR=\"/media/$USER\"" wide ascii
		$s2 = "RECORD_FILE=\"record.txt\"" wide ascii
		$s3 = "copy_files()" wide ascii
		$s4 = "Check for connected USB drives" wide ascii
		$s5 = "Check if filename already exists in record.txt" wide ascii
		$s6 = "Function to copy files from USB drive to destination folder" wide ascii

	condition:
		3 of them
}