SEKOIA_Loader_Amadey_Standalone_May23

rule SEKOIA_Loader_Amadey_Standalone_May23 : FILE
{
	meta:
		description = "Finds standalone samples of Amadey based on characteristic strings"
		author = "Sekoia.io"
		id = "5013586c-5ac3-4c1a-a82e-edce4889eedc"
		date = "2023-05-17"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_amadey_standalone_may23.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "40d2d7a52066ca4e1a65c82ebfa882a77616a1c68f1d315946ab14467787d468"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "\\Amadey\\Release\\Amadey.pdb" ascii
		$hex01 = { 6E 74 64 6C 6C 2E 64 6C  6C 00 00 00 72 75 6E 61 73 }

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}