DITEKSHEN_MALWARE_Win_Beastdoor

rule DITEKSHEN_MALWARE_Win_Beastdoor : FILE
{
	meta:
		description = "Detects Beastdoor backdoor"
		author = "ditekSHen"
		id = "b271d53e-2693-5a93-825a-ef32f72a4b01"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6064-L6084"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d9a72717d124bcf1e3b95850cd524e577abe96a094586a5555faadba78fcb9ad"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "shellx.pif" fullword ascii nocase
		$s2 = "Beasty" fullword ascii
		$s3 = "* Boot:[" ascii
		$s4 = "^ Shut Down:[" ascii
		$s5 = "set cdaudio door" ascii
		$s6 = "This \"Portable Network Graphics\" image is not valid" wide
		$n1 = ".aol.com" ascii
		$n2 = "web.icq.com" ascii
		$n3 = "&fromemail=" fullword ascii
		$n4 = "&subject=" fullword ascii
		$n5 = "&Send=" fullword ascii
		$n6 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword ascii
		$n7 = "mirabilis.com" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 5 of ( $n* ) or ( 3 of ( $s* ) and 3 of ( $n* ) ) )
}