SEKOIA_Backdoor_Win_Ketrum2

import "pe"
import "hash"

rule SEKOIA_Backdoor_Win_Ketrum2
{
	meta:
		description = "Detect Ke3chang's Ketrum backdoor version 2"
		author = "Sekoia.io"
		id = "afcc349a-d44b-4b66-b86f-c62e700fa899"
		date = "2022-10-19"
		modified = "2024-12-19"
		reference = "https://www.intezer.com/blog/research/the-evolution-of-apt15s-codebase-2020/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/backdoor_win_ketrum2.yar#L4-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "271384a078f2a2f58e14d7703febae8a28c6e2d7ddb00a3c8d3eead4ea87a0c0"
		hash = "aa467945dd7b9b095e592fc96384bb385f2c95d00d5424e42bb6ab09827cb0ce"
		hash = "aacaf0d4729dd6fda2e452be763d209f92d107ecf24d8a341947c545de9b7311"
		hash = "ac5cb6e17f094068686225075251153e3eb21dc2d1ae744a97ab113cab034a36"
		logic_hash = "5317b133337ad333c97bbfa6c9d62aea5fd81f3b570f1d6b1ac93ea82062ef61"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "powershell.exe" wide
		$ = "cmd.exe" wide
		$ = "%s\\adult.sft" wide
		$ = "%s\\Notice" wide
		$ = "%s\\Message" wide
		$ = "\\Microsoft\\Media Player" wide
		$ = "Windows\\CurrentVersion\\Explorer\\Shell Folders" wide ascii
		$ = "Windows\\CurrentVersion\\Internet Settings" wide ascii

	condition:
		all of them and for any i in ( 0 .. pe.number_of_resources -1 ) : ( hash.sha256 ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) == "49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e" )
}