Windows_Trojan_Shellter_623c948f

rule Windows_Trojan_Shellter_623c948f {
    meta:
        author = "Elastic Security"
        id = "623c948f-f27c-46dd-9229-e9cb0589da7f"
        fingerprint = "77821228e707e42f1379720a986c6ab4c6dbccb2b8ff108c99dc770fb20a7b5b"
        creation_date = "2026-03-09"
        last_modified = "2026-03-17"
        threat_name = "Windows.Trojan.Shellter"
        reference_sample = "659c8d0fb3d70ac47527e96115062d22aabfe07a841bb8e51cafe0736b817802"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $a = { 8B 45 ?? 0F BE 08 85 C9 74 ?? 8B 55 08 0F BE 02 89 45 F8 8B 4D 08 83 C1 01 89 4D 08 8B 55 FC C1 EA 0D 8B 45 FC C1 E0 13 }
        $b = { 83 E2 ?? 81 E2 ?? 00 00 00 0F B6 C2 B9 ?? 00 00 00 2B C8 BA 04 00 00 00 6B C2 ?? 8B }
        $c = { C7 85 B0 F4 FF FF 00 00 00 00 C7 85 B4 F4 FF FF FF FF FF FF C7 85 B8 F4 FF FF 00 30 00 00 C7 85 BC F4 FF FF 04 00 00 00 8D 45 B8 }
        $d = { 8B 4D FC 8B 91 00 01 00 00 89 55 F4 8B 45 FC 8B 88 }
        $e = { 0F B6 55 FF 8B 45 ?? 03 45 ?? 0F B6 08 33 CA 8B 55 ?? 03 55 ?? 88 0A }
    condition:
        3 of them
}