AVASTTI_Manjusaka_Payload_Encoded_Hexstring

private rule AVASTTI_EXE_PRIVATE : FILE
{
	meta:
		description = "No description has been set in the source file - AvastTI"
		author = "Avast Threat Intel Team"
		id = "1096b81d-5853-5d19-b502-c8166b712a3d"
		date = "2022-08-19"
		modified = "2026-03-11"
		reference = "https://github.com/avast/ioc"
		source_url = "https://github.com/avast/ioc/blob/a450ddabed95984422909c75ac52b6841f685983/Manjusaka/Manjusaka.yar#L9-L13"
		license_url = "N/A"
		logic_hash = "0688672446142f95a22e49a04234cc90b6c9021efeda9ce57034c88d84944663"
		score = 75
		quality = 90
		tags = "FILE"

	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550
}

private rule AVASTTI_ELF_PRIVATE
{
	meta:
		description = "No description has been set in the source file - AvastTI"
		author = "Avast Threat Intel Team"
		id = "38aa7852-e7ea-5b90-a5f6-0862ad19a051"
		date = "2022-08-19"
		modified = "2026-03-11"
		reference = "https://github.com/avast/ioc"
		source_url = "https://github.com/avast/ioc/blob/a450ddabed95984422909c75ac52b6841f685983/Manjusaka/Manjusaka.yar#L1-L7"
		license_url = "N/A"
		logic_hash = "eb05e5d53bb8dea91467a76a164542894cdb1355cf3909f56818e27c589344ec"
		score = 75
		quality = 90
		tags = ""

	strings:
		$h01 = { 7F 45 4C 46 (01|02) (01|02) 01 }

	condition:
		$h01 at 0
}

rule AVASTTI_Manjusaka_Payload_Encoded_Hexstring
{
	meta:
		description = "No description has been set in the source file - AvastTI"
		author = "Gen Threat Labs"
		id = "9799081c-67ec-5ab8-9b23-31f60c05fc05"
		date = "2022-08-19"
		modified = "2026-03-11"
		reference = "https://github.com/gendigitalinc/ioc"
		source_url = "https://github.com/avast/ioc/blob/a450ddabed95984422909c75ac52b6841f685983/Manjusaka/Manjusaka.yar#L64-L93"
		license_url = "N/A"
		logic_hash = "5c0b83e709baea7db6185d888bfa10bab073eb0eb2f3fb72df2da76fff3f6f22"
		score = 75
		quality = 90
		tags = ""

	strings:
		$s01 = "1f8b08000000000000ff7cdd099c1ae5fd3ff031e620c6038d5aea493df18a24c688372626c1180d468d78d465b34b96357be0ee2612354ab5553caa68ad454d158f2a566b51ab454d2dde"
		$s02 = "1f8b08000000000000ff94dd09982355d9fffd62d89a45880a181621804240c10888718328a8ed864144a3029d66ba67d2cc4c4fecee8180a85114f3284b4096b00d619380085111f3284a"
		$s03 = "1f8b08000000000000ff94dd0b982355b5fffde21eee011503a204440d201001317a148278890a1804348ad269667a260d3d33b1bb19820246bc10914bb80811618c80108f084110232204"
		$s04 = "1f8b08000000000000ff94dd07981bd5d9fffdb131208a41b4075123ba280101c6112d88d04468a22b01b25abc6b6bf17aadecae4140008540103582001110401483e8a28b2e4a4074d197"
		$s11 = "1f8b08000000000000ffecbd09784cd7ff077c26c924631977828958c284694d5092da12eb8448ce302108a248628ba82d65862025e924b8aeabdaeaa2abb6bfaebad74f83fe4804a1d5d6"
		$s12 = "1f8b08000000000000ffecbd097414c5faff5d9d7502849e400209201974c4441113371240c8842cd5d00361070502224bdc403203a82c8993d1146d2b7ac5e5ba5cdcb9aea85c36176612"
		$s13 = "1f8b08000000000000ffecbd7b7854d5d928be7632496620710d4874522e9991ad4e94627641491425031378b7ae1150046a1168a1237ca2419801542e893b53b3d8eeafb4b5777b8eb5fd"
		$s14 = "1f8b08000000000000ffecbd7b7854d5d530be4f32496620710f9ae8a45c3223479d28d51c414934960c4c601ddd23a811a845a0858e50d120cc002a97c49369b3399e96b6dacb5bfb7dbe"
		$s15 = "1f8b08000000000000ffecbd79785445d6305eb7934e3a90e676846887451abc68c7b5e33293284b37e924a7e506a222a022c45119501c23744b1c194ce6764b2a97abcc88233a3aaee38a"

	condition:
		(AVASTTI_EXE_PRIVATE or AVASTTI_ELF_PRIVATE ) and ( any of ( $s0* ) and any of ( $s1* ) )
}