SEKOIA_Apt_Lazarus_Vhd_Ransomware_Downloader

rule SEKOIA_Apt_Lazarus_Vhd_Ransomware_Downloader : FILE
{
	meta:
		description = "Detects VHD ransomware downloader"
		author = "Sekoia.io"
		id = "edcc9df8-650c-437a-adb8-a671e8b75e64"
		date = "2022-11-28"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_lazarus_vhd_ransomware_downloader.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "042ab0029d170937af9b9ee6a8e499843532c84cf99faed3d2d47cb18a1500ac"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "rundll32.exe %s #1 %S" wide
		$ = "cmd /c timeout /t 10 & Del /f /q \"%s\" & attrib -s -h \"%s\" & rundll32 \"%s\" #1" wide
		$ = "cmd /c timeout /t 10 & rundll32 \"%s\" #1" wide
		$ = "curl -A cur1-agent -L %s -s -d da"
		$ = "curl -A cur1-agent -L %s -s -d dl"

	condition:
		filesize < 2MB and 3 of them
}