SEKOIA_Wiper_Win_Caddywiper

import "pe"
import "hash"

rule SEKOIA_Wiper_Win_Caddywiper : FILE
{
	meta:
		description = "Detect CaddyWiper"
		author = "Sekoia.io"
		id = "869d44ff-79fc-403d-a45d-d33712da5bd0"
		date = "2022-03-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/wiper_win_caddywiper.yar#L4-L37"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "b66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7"
		hash = "ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72"
		hash = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
		logic_hash = "01a9910b42f402398bbe84546074256f56b10fe0f8524a9a9723aebe43b26a14"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "NETAPI32.dll" ascii
		$ = "DsRoleGetPrimaryDomainInformation" ascii

	condition:
		uint16( 0 ) == 0x5A4D and filesize > 5KB and filesize < 20KB and pe.number_of_sections == 3 and pe.number_of_resources == 0 and all of them or pe.imphash ( ) == "ea8609d4dad999f73ec4b6f8e7b28e55" or pe.imphash ( ) == "bae2d138abe43164fb5e95f313de3d14" or for any i in ( 0 .. pe.number_of_sections -1 ) : ( hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "f0d4c11521fc3891965534e6c52e128b" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "6be6e878d1e8fed277c5feaf60b57a19" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "11f22fc72c3ca7dd6b874bda37c1fe82" )
}