SUSP_DLL_SideLoading_Characteristics_Feb26

rule SUSP_DLL_SideLoading_Characteristics_Feb26 {
   meta:
      description = "Detects suspicious log.dll used by Bitdefender Submission Wizard and seen being used in LotusBlossom toolkit"
      author = "Florian Roth"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      date = "2026-02-03"
      score = 70
      hash1 = "3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad"
      id = "465badb7-f550-5a12-87a0-e6977cbcb208"
   strings:
      $s1 = "log.dll" fullword ascii
   condition:
      uint16(0) == 0x5a4d
      and (  // this is what makes it suspicious
         filesize < 300KB
         or filesize > 500KB
      )
      and pe.exports("LogInit")
      and pe.exports("LogWrite")
      and $s1
      and filename == "log.dll"
}