VOLEXITY_Apt_Malware_Py_Agentpsd

rule VOLEXITY_Apt_Malware_Py_Agentpsd : VERDANTBAMBOO AGENTPSD MEMORY
{
	meta:
		description = "Detection for AgentPSD, a python-based malware typically delivered within PyInstaller-built binaries."
		author = "threatintel@volexity.com"
		id = "4a7d531f-926d-557e-b2a0-d4f103e9c63a"
		date = "2025-09-05"
		modified = "2025-10-30"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2026/2026-06-04 VerdantBamboo/rules.yar#L137-L171"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "ee41e06ed96182ce80cd4544a6abd5d7719c4a5c0e5ddb266a83842d39b99b0a"
		logic_hash = "dd0b957bc2a61ddebd392b86b35bae8c1052a285fa31ccd700e580c2ad9cce59"
		score = 75
		quality = 80
		tags = "VERDANTBAMBOO, AGENTPSD, MEMORY"
		os = "all"
		os_arch = "all"
		scan_context = "memory"
		severity = "critical"
		report1 = "TIB-20251104"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 12297
		version = 5

	strings:
		$s1 = "g_strPhpUrl" ascii
		$s2 = "g_nSleepMinits" ascii
		$s3 = "g_nDuringTime" ascii
		$func1 = "startwork" ascii
		$func2 = "ifrunning" ascii
		$func3 = "getsysinfo" ascii
		$func4 = "getcmdfromweb" ascii
		$func5 = "ParseCmdFromResponse" ascii
		$func6 = "PostDataToServer" ascii
		$func7 = "DealWithBuildinCommand" ascii
		$func8 = "PostBuildinResultToWeb" ascii

	condition:
		2 of ( $s* ) or 4 of ( $func* )
}