LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_008F

rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_008F
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious."
		author = "Florian Roth"
		id = "e3793182-9875-566e-8237-70029c4e9072"
		date = "2026-04-28"
		modified = "2026-09-08"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9fa32adeab865455de8b24cba0bbc0f3439d59f7/detections/yara/yara-rules_mal_drivers.yar#L176-L217"
		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9fa32adeab865455de8b24cba0bbc0f3439d59f7/LICENSE"
		hash = "008fa89822b7a1f91e5843169083202ea580f7b06eb6d5cae091ba844d035f25"
		hash = "02ebf848fa618eba27065db366b15ee6629d98f551d20612ac38b9f655f37715"
		hash = "21617210249d2a35016e8ca6bd7a1edda25a12702a2294d56010ee8148637f5a"
		hash = "2ce4f8089b02017cbe86a5f25d6bc69dd8b6f5060c918a64a4123a5f3be1e878"
		hash = "40556dd9b79b755cc0b48d3d024ceb15bd2c0e04960062ab2a85cd7d4d1b724a"
		hash = "443c0ba980d4db9213b654a45248fd855855c1cc81d18812cae9d16729ff9a85"
		hash = "60ee78a2b070c830fabb54c6bde0d095dff8fad7f72aa719758b3c41c72c2aa9"
		hash = "6964a5d85639baee288555797992861232e75817f93028b50b8c6d34aa38b05b"
		hash = "7662187c236003308a7951c2f49c0768636c492f8935292d02f69e59b01d236d"
		hash = "8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe"
		hash = "82ac05fefaa8c7ee622d11d1a378f1d255b647ab2f3200fd323cc374818a83f2"
		hash = "8b30b2dc36d5e8f1ffc7281352923773fb821cdf66eb6516f82c697a524b599b"
		hash = "a85d3fd59bb492a290552e5124bfe3f9e26a3086d69d42ccc44737b5a66673ec"
		hash = "aafa642ca3d906138150059eeddb6f6b4fe9ad90c6174386cfe13a13e8be47d9"
		hash = "b2486f9359c94d7473ad8331b87a9c17ca9ba6e4109fd26ce92dff01969eaa09"
		hash = "beef40f1b4ce0ff2ee5c264955e6b2a0de6fe4089307510378adc83fad77228b"
		hash = "c7cd14c71bcac5420872c3d825ff6d4be6a86f3d6a8a584f1a756541efff858e"
		hash = "d41e39215c2c1286e4cd3b1dc0948adefb161f22bc3a78756a027d41614ee4ff"
		hash = "d7aa8abdda8a68b8418e86bef50c19ef2f34bc66e7b139e43c2a99ab48c933be"
		hash = "e858de280bd72d7538386a73e579580a6d5edba87b66b3671dc180229368be19"
		hash = "e8743094f002239a8a9d6d7852c7852e0bb63cd411b007bd8c194bcba159ef15"
		hash = "ec96b15ce218f97ec1d8f07f13b052d274c4c8438f31daf246ccfaaee5e1bebd"
		hash = "fefc070a5f6a9c0415e1c6f44512a33e8d163024174b30a61423d00d1e8f9bf2"
		logic_hash = "6104e8d8ad41b46aeae1a0f557c175ab0ac05a76bc66f0142c8fea5216f3a3c2"
		score = 70
		quality = 80
		tags = ""

	strings:
		$ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]6d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a002900 }
		$ = { 43006f006d00700061006e0079004e0061006d006500[1-8]670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 }
		$ = { 460069006c006500560065007200730069006f006e00[1-8]32002e0031002e0031002e003000 }
		$ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]32002e0031002e0031002e003000 }
		$ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]6d0069006d006900640072007600 }
		$ = { 500072006f0064007500630074004e0061006d006500[1-8]6d0069006d006900640072007600200028006d0069006d0069006b00610074007a002900 }
		$ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]6d0069006d0069006400720076002e00730079007300 }
		$ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]43006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c00500059002900 }

	condition:
		all of them
}