DITEKSHEN_MALWARE_Win_Dlagent04

rule DITEKSHEN_MALWARE_Win_Dlagent04 : FILE
{
	meta:
		description = "Detects known downloader agent downloading encoded binaries in patches from paste-like websites, most notably hastebin"
		author = "ditekSHen"
		id = "d591c591-aecc-557e-85b4-1e2589fbfbf9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3247-L3263"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "73e6af7c32d38ec5d1d2bc9f2517860367b46779b53e0faff8885b655561ab01"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.DLAgent04"

	strings:
		$x1 = "@@@http" ascii wide
		$s1 = "HttpWebRequest" fullword ascii
		$s2 = "GetResponseStream" fullword ascii
		$s3 = "set_FileName" fullword ascii
		$s4 = "set_UseShellExecute" fullword ascii
		$s5 = "WebClient" fullword ascii
		$s6 = "set_CreateNoWindow" fullword ascii
		$s7 = "DownloadString" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and #x1 > 1 and 4 of ( $s* )
}