APT_NK_Scarcruft_evolved_ROKRAT

rule APT_NK_Scarcruft_evolved_ROKRAT {
    meta:
        author        = "S2WLAB_TALON_JACK2"
        description   = "Detects RokRAT malware used by ScarCruft APT group"
        type          = "APT"
        version       = "0.1"
        date          = "2021-07-09"
        reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
        id = "53cabf41-0154-5372-b667-60d8a7cb9806"
    strings:
/*
0x140130f25 C744242032311223              mov dword ptr [rsp + 0x20], 0x23123132
0x140130f2d C744242434455667              mov dword ptr [rsp + 0x24], 0x67564534
0x140130f35 C744242878899AAB              mov dword ptr [rsp + 0x28], 0xab9a8978
0x140130f3d C744242C0CBDCEDF              mov dword ptr [rsp + 0x2c], 0xdfcebd0c
0x140130f45 C745F02B7EA516                mov dword ptr [rbp - 0x10], 0x16a57e2b
0x140130f4c C745F428AED2A6                mov dword ptr [rbp - 0xc], 0xa6d2ae28
0x140130f53 C745F8ABF71588                mov dword ptr [rbp - 8], 0x8815f7ab
0x140130f5a C745FC09CF4F3C                mov dword ptr [rbp - 4], 0x3c4fcf09
*/
        $AES_IV_KEY = {
        C7 44 24 ?? 32 31 12 23
        C7 44 24 ?? 34 45 56 67
        C7 44 24 ?? 78 89 9A AB
        C7 44 24 ?? 0C BD CE DF
        C7 45 ?? 2B 7E A5 16
        C7 45 ?? 28 AE D2 A6
        C7 45 ?? AB F7 15 88
        C7 45 ?? 09 CF 4F 3C
        }
/*
0x14012b637 80E90F                        sub cl, 0xf
0x14012b63a 80F1C8                        xor cl, 0xc8
0x14012b63d 8848FF                        mov byte ptr [rax - 1], cl
0x14012b640 4883EA01                      sub rdx, 1
*/
       $url_deocde = {
               80 E9 0F
               80 F1 C8
               88 48 ??
               48 83 EA 01  }
    condition:
        uint16(0) == 0x5A4D and
        any of them
}