SEKOIA_Launcher_Win_Romcom_Launcher

rule SEKOIA_Launcher_Win_Romcom_Launcher : FILE
{
	meta:
		description = "Detect the launcher of RomCom malware"
		author = "Sekoia.io"
		id = "e8fa8239-a763-4be2-8f34-8e112e65b35e"
		date = "2022-11-04"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/launcher_win_romcom_launcher.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "7d94f187c3fb85cbfe961dd3b292dc1abd36a8cee7c9ff9ec08c4c1e23d38588"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = {43 3a 5c 55 73 65 72 73 5c 31 32 33 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 69 6e 73 5f 61 73 69 5c 57 69 6e 33 32 5c 52 65 6c 65 61 73 65 5c 73 65 74 75 70 2e 70 64 62}

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}