DITEKSHEN_MALWARE_Win_Klingonrat

rule DITEKSHEN_MALWARE_Win_Klingonrat : FILE
{
	meta:
		description = "Detects KlingonRAT"
		author = "ditekSHen"
		id = "bea50bce-b38c-50a0-902a-1014615bd9b8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6405-L6427"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2abfbfc1b67f931f15bfdfd2cd4ba7821e62eb8c518bbc04629c0dd694bbd9c1"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$go = "Go build ID:" ascii
		$s1 = "/UCRelease/src/client/uac/once/"
		$s2 = "%T\\AppData\\Local\\Windows Update\\"
		$s3 = "%TSoftware\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\"
		$s4 = "wmic /namespace:'\\\\root\\subscription' PATH"
		$s5 = "C:\\Windows\\System32\\fodhelper.exeCaption,ParentProcessId,ProcessId"
		$s6 = "ldpro.exelsass.exeluall.exeluspt.exe"
		$s7 = "scangui.exedeps/lsass.exeetrustcipe.exefile"
		$s8 = "alogserv.exeaplica32.exeapvxdwin.exeatro55en.exeautodown.exeavconsol.exeavgserv9.exeavkwctl9.exeavltmain.exeavpdos32.exeavsynmgr.exeavwupd32.exeavwupsrv.exe"
		$c1 = "%s/keyLogger?machineId=%s" ascii
		$c2 = "%s/stealer?machineId=%s" ascii
		$c3 = "%s/lsass?machineId=%s" ascii
		$c4 = "%s/logger?machineId=%s" ascii
		$c5 = "%s/machineInfo?machineId=%s" ascii
		$c6 = "failurehttps://%s:%d/botif-modified-sinceillegal" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( $go ) and ( 3 of ( $c* ) or 5 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $c* ) ) )
}