DITEKSHEN_MALWARE_Win_Epicenterrat

rule DITEKSHEN_MALWARE_Win_Epicenterrat : FILE
{
	meta:
		description = "Detects EpicenterRAT"
		author = "ditekSHen"
		id = "6abe6e94-d7f5-5f88-96a6-a8fad599ef6a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6841-L6863"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e9086dff22e301f57c6a9bdb38fbed8e902d5b8ca20a5e5b3cda56db08d5582e"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$pdb1 = "c:\\Users\\Zombie\\Desktop\\MutantNinja\\" ascii
		$pdb2 = "\\Epicenter Client\\" ascii
		$s1 = "PROCESS_LIST<%SEP%>" fullword wide
		$s2 = "GETREADY_RECV_FILE<%SEP%>" fullword wide
		$s3 = "DISPLAY<%SEP%>" wide
		$s4 = "GETSCREEN<%SEP%>" fullword wide
		$s5 = "dumpImageName" fullword ascii
		$s6 = "dumpLoc" fullword ascii
		$s7 = "EXPECT<%SEP%>filelist<%SEP%>" fullword wide
		$s8 = "<%FSEP%>FOLDER<%FSEP%>-<%SEP%>" fullword wide
		$s9 = "KILLPROC<%SEP%>" fullword wide
		$s10 = "LAUNCHPROC<%SEP%>" fullword wide
		$s11 = "cmd.exe /c start /b " fullword wide
		$s12 = "savservice" fullword wide
		$s13 = "getvrs" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $pdb* ) or 5 of ( $s* ) )
}