VOLEXITY_Apt_Malware_Vbs_Basicstar_A

rule VOLEXITY_Apt_Malware_Vbs_Basicstar_A : CHARMINGCYPRESS FILE MEMORY
{
	meta:
		description = "VBS backdoor which bares architectural similarity to the POWERSTAR malware family."
		author = "threatintel@volexity.com"
		id = "e790defe-2bd5-5629-8420-ce8091483589"
		date = "2024-01-04"
		modified = "2025-05-21"
		reference = "TIB-20240111"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2024/2024-02-13 CharmingCypress/rules.yar#L69-L99"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "c6f91e5585c2cbbb8d06b7f239e30b271f04393df4fb81815f6556fa4c793bb0"
		logic_hash = "977bb42553bb6585c8d0e1e89675644720ca9abf294eccd797e20d4bca516810"
		score = 75
		quality = 80
		tags = "CHARMINGCYPRESS, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		report2 = "TIB-20240126"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10037
		version = 8

	strings:
		$s1 = "Base64Encode(EncSess)" ascii wide
		$s2 = "StrReverse(PlainSess)" ascii wide
		$s3 = "ComDecode, \"Module\"" ascii wide
		$s4 = "ComDecode, \"SetNewConfig\"" ascii wide
		$s5 = "ComDecode, \"kill\"" ascii wide
		$magic = "cmd /C start /MIN curl --ssl-no-revoke -s -d " ascii wide

	condition:
		3 of ( $s* ) or $magic
}