SEKOIA_Win_Malware_Statc_Downloader

rule SEKOIA_Win_Malware_Statc_Downloader : FILE
{
	meta:
		description = "Statc Downloader powershell script. Base64 powershell"
		author = "Sekoia.io"
		id = "4a2e9607-635b-4cd8-ba27-d70e0c76fd45"
		date = "2023-08-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/win_malware_statc_downloader.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "173ea5af2e71b6ed70abd52a5d2f4de040393a6d2ff4978bbb6e73d96742b010"
		logic_hash = "a99970a6ace88234e5e2bda009f8d87e6a0dc8c1a4655cca128e30292a21502c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$powershell = "powershell.exe"
		$a1 = "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBjAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAGYAaQBsAGUAKAAiAGgAdAB0AHAAcwA6AC8A"
		$a2 = "gATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABmAGkAbABlACgAIgBoAHQAdABwAHMAOgAvA"
		$a3 = "oAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACIAaAB0AHQAcABzADoALw"
		$b1 = "aQBuAHYAbwBrAGUALQBlAHgAcAByAGUAcwBzAGkAbwBuACAAIgAkAGUAbgB2ADoAVABFAE0AUABc"
		$b2 = "kAbgB2AG8AawBlAC0AZQB4AHAAcgBlAHMAcwBpAG8AbgAgACIAJABlAG4AdgA6AFQARQBNAFAAX"
		$b3 = "pAG4AdgBvAGsAZQAtAGUAeABwAHIAZQBzAHMAaQBvAG4AIAAiACQAZQBuAHYAOgBUAEUATQBQAF"
		$c1 = "MQAgADEAIgA7ACAAIgBPAEsAIgA7"
		$c2 = "EAIAAxACIAOwAgACIATwBLACIAO"
		$c3 = "xACAAMQAiADsAIAAiAE8ASwAiAD"

	condition:
		$powershell at 0 and 1 of ( $a* ) and 1 of ( $b* ) and 1 of ( $c* ) and filesize < 1MB
}