APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine

rule APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine {
     meta:
       author        = "S2WLAB_TALON_JACK2"
       description   = "Detects Ruby ShellCode XOR routine used by ScarCruft APT group"
       type          = "APT"
       version       = "0.1"
       date          = "2021-05-20"
       reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
       id = "c393f2db-8ade-5083-9cec-f62f23056f8b"
     strings:
         /*
         8B 4C 18 08             mov     ecx, [eax+ebx+8]
         C1 C7 0D                rol     edi, 0Dh
         40                      inc     eax
         F6 C7 01                test    bh, 1
         74 06                   jz      short loc_D0
         81 F7 97 EA AE 78       xor     edi, 78AEEA97h
         */
         $hex1   = {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7}
         /*
         41 C1 C2 0D             rol     r10d, 0Dh
         41 8B C2                mov     eax, r10d
         44 8B CA                mov     r9d, edx
         41 8B CA                mov     ecx, r10d
         41 81 F2 97 EA AE 78    xor     r10d, 78AEEA97h
         */
         $hex2   = {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2}
     condition:
         1 of them
 }