SIGNATURE_BASE_MAL_CRIME_RAT_WIN_PE_Godrat_Aug25

import "pe"

rule SIGNATURE_BASE_MAL_CRIME_RAT_WIN_PE_Godrat_Aug25 : GODRAT RAT WINDOWS GH0ST_RAT GETGOD FILE
{
	meta:
		description = "Detects GodRAT malware targeting Windows systems"
		author = "Arda Buyukkaya"
		id = "e6ec0af5-71d3-520a-a671-8634ac2f926f"
		date = "2025-08-23"
		modified = "2026-05-15"
		reference = "https://securelist.com/godrat/117119/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_crime_win_pe_godrat_aug25.yar#L4-L80"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "154e800ed1719dbdcb188c00d5822444717c2a89017f2d12b8511eeeda0c2f41"
		logic_hash = "eda3175277bbf9f6408f5d2dd25d6780552aad4104fe62bb92125c734f9fdd98"
		score = 75
		quality = 83
		tags = "GODRAT, RAT, WINDOWS, GH0ST RAT, GETGOD, FILE"
		family = "GodRAT"
		victims = "Financial services"

	strings:
		$winrt_txt = "C++/WinRT version" ascii wide nocase
		$api_blob = {
         4E 74 43 72 65 61 74 65 53 65 63 74 69 6F 6E 00                          // NtCreateSection
         4E 74 4D 61 70 56 69 65 77 4F 66 53 65 63 74 69 6F 6E 00 00              // NtMapViewOfSection
         4E 74 55 6E 6D 61 70 56 69 65 77 4F 66 53 65 63 74 69 6F 6E 00 00 00 00  // NtUnmapViewOfSection
      }
		$ld_movups = { 0F 10 05 ?? ?? ?? ?? }
		$ld_movq = { F3 0F 7E 05 ?? ?? ?? ?? }
		$st_movups = { 0F 11 85 ?? ?? ?? ?? }
		$st_movq = { 66 0F D6 85 ?? ?? ?? ?? }
		$scan_loop = { 8A 01 41 84 C0 75 F9 }
		$cmp_len_770 = { 81 FF 70 07 00 00 0F 82 ?? ?? ?? ?? }
		$cmp_len_76C = { 81 FF 6C 07 00 00 0F 82 ?? ?? ?? ?? }

	condition:
		pe.is_pe and filesize <= 10MB and ( ( $winrt_txt and ( pe.imphash ( ) == "0f4b0270c84616ce594b6a84c47a7717" ) ) or ( ( $ld_movups or $ld_movq ) and ( ( #st_movups >= 2 ) or ( #st_movq >= 2 ) or ( #st_movups >= 1 and #st_movq >= 1 ) ) and $scan_loop and $api_blob and ( $cmp_len_770 or $cmp_len_76C ) ) or pe.imphash ( ) == "ee5ea868d8233000216e7b29bc8cb4e2" )
}