VOLEXITY_Apt_Malware_Rb_Rokrat_Loader

rule VOLEXITY_Apt_Malware_Rb_Rokrat_Loader : INKYPINE FILE MEMORY
{
	meta:
		description = "Ruby loader seen loading the ROKRAT malware family."
		author = "threatintel@volexity.com"
		id = "69d09560-a769-55d3-a442-e37f10453cde"
		date = "2021-06-22"
		modified = "2024-08-22"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L1-L32"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "5bc52f6c1c0d0131cee30b4f192ce738ad70bcb56e84180f464a5125d1a784b2"
		logic_hash = "30ae14fd55a3ab60e791064f69377f3b9de9b871adfd055f435df657f89f8007"
		score = 75
		quality = 80
		tags = "INKYPINE, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5598
		version = 7

	strings:
		$magic1 = "'https://update.microsoft.com/driverupdate?id=" ascii wide
		$magic2 = "sVHZv1mCNYDO0AzI';" ascii wide
		$magic3 = "firoffset..scupd.size" ascii wide
		$magic4 = /alias UrlFilter[0-9]{2,5} eval;"/
		$s1 = "clRnbp9GU6oTZsRGZpZ"
		$s2 = "RmlkZGxlOjpQb2ludGVy"
		$s3 = "yVGdul2bQpjOlxGZklmR"
		$s4 = "XZ05WavBlO6UGbkRWaG"

	condition:
		any of ( $magic* ) or any of ( $s* )
}