SEKOIA_Installer_Win_Minibus

import "pe"
import "hash"

rule SEKOIA_Installer_Win_Minibus : FILE
{
	meta:
		description = "Detect MINIBUS installer"
		author = "Sekoia.io"
		id = "0f7f600d-d93b-4b5a-aa0e-7d91038409e6"
		date = "2024-04-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/installer_win_minibus.yar#L4-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "26ca51cb067e1fdf1b8ad54ba49883bc5d1945952239aec0c4840754bff76621"
		hash = "90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020"
		logic_hash = "24326c9f5dcb7e66d47b65bf6bec6fe78be18c8d41a3039fbd09b453568a3f8f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "\\essential.dat"
		$ = "TorvaldInitial.dll"

	condition:
		uint16be( 0 ) == 0x4d5a and 1 of them or for any i in ( 0 .. pe.number_of_resources -1 ) : ( hash.sha256 ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) == "de3fb5d4419eb6b943872dd6e3dd93d19584ef2b158aa3158b3b09f0a9b628ef" )
}