MAL_APT_NK_Andariel_HHSD_FileTransferTool

rule MAL_APT_NK_Andariel_HHSD_FileTransferTool {
   meta:
      author = "CISA.gov"
      description = "Detects a variant of the HHSD File Transfer Tool"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      modified = "2025-07-09"
      score = 70
      id = "46b6dbaf-1272-5bbd-a586-5e48ba6c5022"
   strings:
      // 30 4D C7                xor     [rbp+buffer_v41+3], cl
      // 81 7D C4 22 C0 78 00    cmp      dword ptr [rbp+buffer_v41], 78C022h
      // 44 88 83 00 01 00 00    mov      [rbx+100h], r8b
      $handshake = { 30 ?? ?? 81 7? ?? 22 C0 78 00 4? 88 }

      // B1 14                   mov     cl, 14h
      // C7 45 F7 14 00 41 00    mov      [rbp+57h+Src], 410014h
      // C7 45 FB 7A 00 7F 00    mov      [rbp+57h+var_5C], 7F007Ah
      // C7 45 FF 7B 00 63 00    mov     [rbp+57h+var_58], 63007Bh
      // C7 45 03 7A 00 34 00    mov      [rbp+57h+var_54], 34007Ah
      // C7 45 07 51 00 66 00    mov      [rbp+57h+var_50], 660051h
      // C7 45 0B 66 00 7B 00    mov      [rbp+57h+var_4C], 7B0066h
      // C7 45 0F 66 00 00 00    mov      [rbp+57h+var_48], 66h ; 'f'
      $err_xor_str = { 14 C7 [2] 14 00 41 00 C7 [2] 7A 00 7F 00 C7 [2] 7B 00 63 00 C7 [2] 7A 00 34 00 }

      // 41 02 D0                add     dl, r8b
      // 44 02 DA                add     r11b, dl
      // 3C 1F                   cmp     al, 1Fh
      // $buf_add_cmp_1f = { 4? 02 ?? 4? 02 ?? 3? 1F }      removed due to 1 byte atom
      // B9 8D 10 B7 F8          mov     ecx, 0F8B7108Dh
      // E8 F1 BA FF FF          call    sub_140001280
      $hash_call_loadlib = { B? 8D 10 B7 F8 E8 }
      $hash_call_unk = { B? 91 B8 F6 88 E8 }
   condition:
      uint16(0) == 0x5a4d
      and 1 of ($handshake, $err_xor_str)
      and 1 of ($hash_call_*)
      or 2 of ($handshake, $err_xor_str)
}