SEKOIA_Backdoor_Win_Sponsor

rule SEKOIA_Backdoor_Win_Sponsor : FILE
{
	meta:
		description = "Detect the Sponsor backdoor"
		author = "Sekoia.io"
		id = "d410cdb7-a2a8-481e-a90a-49ef15a7a0e3"
		date = "2024-03-29"
		modified = "2024-12-19"
		reference = "https://www.welivesecurity.com/en/eset-research/sponsor-batch-filed-whiskers-ballistic-bobcats-scan-strike-backdoor/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/backdoor_win_sponsor.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "e5ee874bd59bb2a6dec700686544e7914312abff166a7390b34f7cb29993267a"
		hash = "e2b74ed355d68bed2e7242baecccd7eb6eb480212d6cc54526bc4ff7e6f57629"
		hash = "2a99cf7d73d453f3554e24bf3efa49d8109da9e8543db815a8f813559d083f8f"
		hash = "c4dbda41c726af9ba3d9224f2e38fc433d2b60f4a23512437adeae8ef8986c57"
		logic_hash = "844104863e8e0c49da3a41d39fe210e01329eeaecec6ffc231aae12392773ef6"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "Content-Type: application/x-www-form-urlencoded"
		$ = "SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation"
		$ = "\\Uninstall.bat"
		$ = "\\config.txt"
		$ = "\\node.txt"

	condition:
		uint16be( 0 ) == 0x4d5a and all of them
}