DITEKSHEN_MALWARE_Win_Iamthekingkingofhearts

rule DITEKSHEN_MALWARE_Win_Iamthekingkingofhearts : FILE
{
	meta:
		description = "IAmTheKing King Of Hearts payload"
		author = "ditekSHen"
		id = "95c73ec0-75b0-5d46-87da-b30feb170716"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1823-L1843"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "75b6dd0ebb90fd04f9e4a0b1fc6a1bbf417fc66daad24c8b01f0390f6155ec55"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "write info fail!!! GetLastError-->%u" fullword ascii
		$s2 = "LookupAccountSid Error %u" fullword ascii
		$s3 = "CreateServiceErrorID:%d" fullword ascii
		$s4 = "In ControlServiceErrorID:%d" fullword ascii
		$s5 = "In QueryServiceStatus ErrorID:%d" fullword ascii
		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
		$s7 = "hello%s" fullword ascii
		$s8 = "additional header failed..." fullword ascii
		$s9 = "Set Option failed errcode: %ld" fullword ascii
		$s10 = "add cookie failed..." fullword ascii
		$u1 = "Mozilla/4.0 (compatible; )" fullword ascii
		$u2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $u* ) and 4 of ( $s* ) ) or ( all of ( $u* ) and 3 of ( $s* ) ) or ( 5 of them ) )
}