SEKOIA_Apt_Andariel_Dorarat_Strings

rule SEKOIA_Apt_Andariel_Dorarat_Strings : FILE
{
	meta:
		description = "Detects Dora RAT based on strings"
		author = "Sekoia.io"
		id = "30388291-a287-489f-a060-c90a16cda217"
		date = "2024-06-17"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_andariel_dorarat_strings.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "21e1c77d486cbf6ddaa2eca673275c7c21cc59fa9551c2eb02c526518ed5b217"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$x1 = "/encryption.go" ascii fullword
		$x2 = "/handshake.go" ascii fullword
		$x3 = "/trans_module.go" ascii fullword
		$enc_rsc = { 14 02 72 14 D3 4C 4A 49 55 36 14 DF 8D 6F 2D CF }

	condition:
		uint16be( 0 ) == 0x4d5a and ( all of ( $x* ) or $enc_rsc )
}