SIGNATURE_BASE_MAL_Sindoor_Decryptor_Aug25

rule SIGNATURE_BASE_MAL_Sindoor_Decryptor_Aug25 : FILE
{
	meta:
		description = "Detects AES decryptor used by Sindoor dropper related to APT 36"
		author = "Pezier Pierre-Henri"
		id = "3c0c5217-b125-51a3-8129-30af5f0c7263"
		date = "2025-08-29"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt36_operation_sindoor.yar#L38-L63"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b"
		logic_hash = "4172fd9aee39a1a0681483f6dada6394debc62149a588ab4807e3016a823bed3"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "Go build"
		$s2 = "main.rc4EncryptDecrypt"
		$s3 = "main.processFile"
		$s4 = "main.deriveKeyAES"
		$s5 = "use RC4 instead of AES"

	condition:
		filesize < 100MB and ( uint16( 0 ) == 0x5a4d or uint32be( 0 ) == 0x7f454c46 or ( uint32be( 0 ) == 0xcafebabe and uint32be( 4 ) < 0x20 ) or uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xfeedfacf ) and all of them
}