Windows_Trojan_PikaBot_5441f511

rule Windows_Trojan_PikaBot_5441f511 {
    meta:
        author = "Elastic Security"
        id = "5441f511-82f2-4971-b9ff-7fe739041357"
        fingerprint = "7a90c7e21ebffd6276bd53e37d4a09df29d3d1167024b96a39504518f0a38dfe"
        creation_date = "2024-02-15"
        last_modified = "2024-02-21"
        description = "Related to Pikabot core"
        threat_name = "Windows.Trojan.PikaBot"
        reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
        severity = 100
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $handler_table = { 72 26 [6] 6F 24 [6] CB 0A [6] 6C 03 [6] 92 07 }
        $api_hashing = { 3C 60 76 ?? 83 E8 20 8B 0D ?? ?? ?? ?? 6B FF 21 }
        $debug_check = { A1 ?? ?? ?? ?? FF 50 ?? 50 50 80 7E ?? 01 74 ?? 83 7D ?? 00 75 ?? }
        $checksum = { 55 89 E5 8B 55 08 69 02 E1 10 00 00 05 38 15 00 00 89 02 5D C3 }
        $load_sycall = { 8F 05 ?? ?? ?? ?? 83 C0 04 50 8F 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 A3 ?? ?? ?? ?? 31 C0 64 8B 0D C0 00 00 00 85 C9 }
        $read_xbyte_config = { 8B 43 04 8B 55 F4 B9 FC FF FF FF 83 C0 04 29 D1 01 4B 0C 8D 0C 10 89 4B 04 85 F6 ?? ?? 89 16 89 C3 }
    condition:
        2 of them
}