DITEKSHEN_MALWARE_Win_R77

import "pe"

rule DITEKSHEN_MALWARE_Win_R77 : FILE
{
	meta:
		description = "Detects r77 rootkit"
		author = "ditekSHen"
		id = "813d207e-c6d9-5fea-8387-19da33bc3317"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11192-L11217"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e3ec6e88a3a77b7dc69eb51a528e6417f6b8695c7cb01d699cf248cebd9b84e2"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "startup" fullword wide
		$s2 = "process_names" fullword wide
		$s3 = "paths" fullword wide
		$s4 = "service_names" fullword wide
		$s5 = "tcp_local" fullword wide
		$s6 = "tcp_remote" fullword wide
		$s7 = "\\\\.\\pipe\\" wide
		$s8 = "SOFTWARE\\" wide

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 5 of them and pe.exports ( "ReflectiveDllMain" ) ) or ( 5 of them and for any i in ( 0 .. pe.number_of_sections ) : ( ( pe.sections [ i ] . name == ".detourd" ) ) ) )
}