SEKOIA_Ta410_Control_Flow_Obfuscation

rule SEKOIA_Ta410_Control_Flow_Obfuscation : FILE
{
	meta:
		description = "Detects control flow obfuscation used by TA410 in XXXModule_dlcore0"
		author = "Sekoia.io"
		id = "2a784f9b-3624-4c5d-8a64-db7d3c33a8f7"
		date = "2022-10-11"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/ta410_control_flow_obfuscation.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "6cf78943728286d0bddd99049d81065673ab7f679029cdd5f5dc69f90197136e"
		logic_hash = "3ee6ee07e7a7be285290ec91de649afff3e5dc222bcfc58709b642d4dd53dc41"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$chunk_1 = {
        E8 ?? ?? ?? ??
        83 C0 10
        3D 00 00 00 80
        7D 01
        EB ff
        }
		$chunk_2 = {83 C0 10 3D 00 00 00 80 7d 01 eb ff e0 50 c3 75}

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 10MB and any of them
}