SEKOIA_Apt_Gamaredon_Ddrdoh_Vbs_Downloader

rule SEKOIA_Apt_Gamaredon_Ddrdoh_Vbs_Downloader : FILE
{
	meta:
		description = "Detects the core of the VBS Gamaredon's Telegram Downloader"
		author = "Sekoia.io"
		id = "c934b95d-d81d-4f58-a752-1bb31ba8593d"
		date = "2023-01-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_gamaredon_ddrdoh_vbs_downloader.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "940635313b23e29ac98310fc0f20352405c96190d56cd36ef028bf4d6e77fa6b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$a1 = "==([0-9\\@]+)==" ascii
		$a2 = "data\"\":\"\"(.*?)" ascii
		$a3 = ", vbcr ,\"\")" ascii
		$a4 = ", vblf ,\"\")" ascii
		$a5 = ", \"&&\" ,\"\")" ascii
		$a6 = "ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4" ascii
		$b1 = "==([0-9\\@]+)==" base64
		$b2 = "data\"\":\"\"(.*?)" base64
		$b3 = ", vbcr ,\"\")" base64
		$b4 = ", vblf ,\"\")" base64
		$b5 = ", \"&&\" ,\"\")" base64
		$b6 = "ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4" base64

	condition:
		(4 of ( $a* ) or 4 of ( $b* ) ) and filesize < 50KB
}