DITEKSHEN_MALWARE_Win_Karkoff

rule DITEKSHEN_MALWARE_Win_Karkoff : FILE
{
	meta:
		description = "Detects Karkoff"
		author = "ditekSHen"
		id = "7d2fe783-18b3-5d84-a9b5-e8e0b5a0db98"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5298-L5313"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e9b6ba5be2b3cd0faa898347e57cee5a57b80b19842c3a1ddb42d620307c8b39"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$x1 = "C:\\Windows\\Temp\\MSEx_log.txt" fullword wide
		$x2 = "CMD.exe" fullword wide
		$x3 = "Karkoff.ProjectInstaller.resources" fullword ascii
		$s1 = /try\shttp(s)?\s(ip|domain)/ fullword wide
		$s2 = "Reg cleaned!" fullword wide nocase
		$s3 = "Content-Disposition: form-data; name=\"{1}\"" fullword wide
		$s4 = "^[A-Fa-f0-9]{8}-([A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}$" fullword wide
		$s5 = "new backdoor" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 4 of ( $s* ) or ( 2 of ( $x* ) and 2 of ( $s* ) ) )
}